# DNS spyware rules by Jack Pepper ( pepperjack@autoshun.org ) # regenerated daily from the domains.txt file at David Glosser's Black hole DNs project # The URL for BHDNS project: http://www.malwaredomains.com/files/domains.txt # The source URL for this http://www.autoshun.org/downloads/bhdns.rules # # A hit on one of these rules indicates is that the dumass user clicked # on something shiny, or has spyware installed, or visited a site that # tried to do a driveby install. # # Sun, 19 Feb 2012 02:12:14 -0600 # Error on # domains list from bhdns # Error on # Defective domain declaration: ## If you do not accept these term then do not use this information. # Error on # Defective domain declaration: ## For noncommercial use only. Using this information indicates you agree to be bound by these terms. alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fzdqjn.cn IMMORTAL (Malware_Distribution)"; content:"|06|fzdqjn|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628222; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newpartyworld.com IMMORTAL (Malware_Distribution)"; content:"|0d|newpartyworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619964; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup enlaceseducativos.com.ar IMMORTAL (Malware_Distribution)"; content:"|11|enlaceseducativos|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619818; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ixeajki.cn IMMORTAL (Malware_Distribution)"; content:"|07|ixeajki|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619909; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nkphcoop.com IMMORTAL (Malware_Distribution)"; content:"|08|nkphcoop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619966; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup reflexoterapiemasaj-vacuum.ro IMMORTAL (Malware_Distribution)"; content:"|1a|reflexoterapiemasaj-vacuum|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619995; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup theonscreen.com IMMORTAL (Malware_Distribution)"; content:"|0b|theonscreen|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628915; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup topbusinesscoaches.com IMMORTAL (Malware_Distribution)"; content:"|12|topbusinesscoaches|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629065; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vitrineoeste.com.br IMMORTAL (Malware_Distribution)"; content:"|0c|vitrineoeste|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628922; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wwwsarkozy.eu IMMORTAL (Malware_Distribution)"; content:"|0a|wwwsarkozy|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620147; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xn--iimizmzik-v9a79h.com IMMORTAL (Malware_Distribution)"; content:"|14|xn--iimizmzik-v9a79h|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628926; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rcturbo.com IMMORTAL (Malware_Distribution)"; content:"|07|rcturbo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628119; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup regalachiefs.com IMMORTAL (Malware_Distribution)"; content:"|0c|regalachiefs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628046; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup matzines.com IMMORTAL (Malware_Distribution)"; content:"|08|matzines|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626784; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qsfgyee.com IMMORTAL (Malware_Distribution)"; content:"|07|qsfgyee|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619989; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup elcombra.de IMMORTAL (Malware_Distribution)"; content:"|08|elcombra|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628400; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup angelesrodriguez.com.ar IMMORTAL (Malware_Distribution)"; content:"|10|angelesrodriguez|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628949; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup apysvirtual.com.ar IMMORTAL (Malware_Distribution)"; content:"|0b|apysvirtual|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628952; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ascomaformation.info IMMORTAL (Malware_Distribution)"; content:"|0f|ascomaformation|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628954; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup autohton2005.ro IMMORTAL (Malware_Distribution)"; content:"|0c|autohton2005|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628956; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup azadtravels.co.uk IMMORTAL (Malware_Distribution)"; content:"|0b|azadtravels|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628957; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestfinderr.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bestfinderr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626748; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bitaid.nl IMMORTAL (Malware_Distribution)"; content:"|06|bitaid|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628962; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup carita.pl IMMORTAL (Malware_Distribution)"; content:"|06|carita|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628968; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup centrepassatge.com IMMORTAL (Malware_Distribution)"; content:"|0e|centrepassatge|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628969; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup citygroupservices.com IMMORTAL (Malware_Distribution)"; content:"|11|citygroupservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628972; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup coll-med6.freevar.com IMMORTAL (Malware_Distribution)"; content:"|09|coll-med6|07|freevar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628973; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup darkscape.info IMMORTAL (Malware_Distribution)"; content:"|09|darkscape|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628976; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup devision-sharks.ru IMMORTAL (Malware_Distribution)"; content:"|0f|devision-sharks|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619808; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup doitbig.org IMMORTAL (Malware_Distribution)"; content:"|07|doitbig|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628982; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup emugyk.cn IMMORTAL (Malware_Distribution)"; content:"|06|emugyk|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628991; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup equipeworldsound.com.br IMMORTAL (Malware_Distribution)"; content:"|10|equipeworldsound|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628993; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup escuela60guatrache.com.ar IMMORTAL (Malware_Distribution)"; content:"|12|escuela60guatrache|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628995; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup igraemvpingpong.ru IMMORTAL (Malware_Distribution)"; content:"|0f|igraemvpingpong|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629010; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup isshl.com IMMORTAL (Malware_Distribution)"; content:"|05|isshl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629016; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kapaone.org IMMORTAL (Malware_Distribution)"; content:"|07|kapaone|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629018; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup moatarian.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|moatarian|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629031; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup moblehasehmi.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0c|moblehasehmi|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629032; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup radarodz300.com IMMORTAL (Malware_Distribution)"; content:"|0b|radarodz300|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629044; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup smileidea.com IMMORTAL (Malware_Distribution)"; content:"|09|smileidea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629055; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup strategiccapitalalliance.com IMMORTAL (Malware_Distribution)"; content:"|18|strategiccapitalalliance|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629057; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup today-newday.cn IMMORTAL (Malware_Distribution)"; content:"|0c|today-newday|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628652; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5g.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619237; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bayram-197.com IMMORTAL (Malware_Distribution)"; content:"|0a|bayram-197|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628961; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fotoris.com IMMORTAL (Malware_Distribution)"; content:"|07|fotoris|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628405; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gclub1688.net IMMORTAL (Malware_Distribution)"; content:"|09|gclub1688|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628541; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsccleveland.com IMMORTAL (Malware_Distribution)"; content:"|0c|gsccleveland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628100; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup haggar.cl IMMORTAL (Malware_Distribution)"; content:"|06|haggar|02|cl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628228; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup idamusti.dk IMMORTAL (Malware_Distribution)"; content:"|08|idamusti|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628414; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jubailcityplanning.com IMMORTAL (Malware_Distribution)"; content:"|12|jubailcityplanning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628417; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup limosforhenparties.co.uk IMMORTAL (Malware_Distribution)"; content:"|12|limosforhenparties|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628104; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup repair.ivyro.net IMMORTAL (Malware_Distribution)"; content:"|06|repair|05|ivyro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628508; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sagri.org IMMORTAL (Malware_Distribution)"; content:"|05|sagri|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628308; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup salinasenterprise.com IMMORTAL (Malware_Distribution)"; content:"|11|salinasenterprise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628447; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fopsl.cn IMMORTAL (Malware_Infectors)"; content:"|05|fopsl|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620258; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adsnet.biz IMMORTAL (Malware_Distribution)"; content:"|06|adsnet|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619719; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup directbinary.com IMMORTAL (Malware_Distribution)"; content:"|0c|directbinary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619810; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fd1a234sa.com IMMORTAL (Malware_Distribution)"; content:"|09|fd1a234sa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619832; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freead.name IMMORTAL (Malware_Distribution)"; content:"|06|freead|04|name"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619840; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fuchroot.com IMMORTAL (Malware_Distribution)"; content:"|08|fuchroot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619844; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ilui45iu7.com IMMORTAL (Malware_Distribution)"; content:"|09|ilui45iu7|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619897; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lkfjfuisdh.com IMMORTAL (Malware_Distribution)"; content:"|0a|lkfjfuisdh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619929; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tottaldomain.cn IMMORTAL (Malware_Distribution)"; content:"|0c|tottaldomain|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620088; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wdggtwegww.com IMMORTAL (Malware_Distribution)"; content:"|0a|wdggtwegww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620131; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup d99q.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|04|d99q|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622749; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eracou.com IMMORTAL (Malware_Distribution)"; content:"|06|eracou|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622519; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup correndo.se IMMORTAL (Malware_Distribution)"; content:"|08|correndo|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631586; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup most-mammals.com IMMORTAL (Malware_Distribution)"; content:"|0c|most-mammals|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631641; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup paramworld.com IMMORTAL (Malware_Distribution)"; content:"|0a|paramworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619393; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rts-me.com IMMORTAL (Malware_Distribution)"; content:"|06|rts-me|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628511; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup smallcap360.com IMMORTAL (Malware_Distribution)"; content:"|0b|smallcap360|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632360; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hotnuded.info IMMORTAL (Malware_Distribution)"; content:"|08|hotnuded|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630592; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup macromediasetup.com IMMORTAL (Malware_Infectors)"; content:"|0f|macromediasetup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619351; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 372kzsds7661.com IMMORTAL (Malware_Distribution)"; content:"|0c|372kzsds7661|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630723; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a2construction.net IMMORTAL (Malware_Distribution)"; content:"|0e|a2construction|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619709; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup agalp.ro IMMORTAL (Malware_Distribution)"; content:"|05|agalp|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630211; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup agropharma.com.ar IMMORTAL (Malware_Distribution)"; content:"|0a|agropharma|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628945; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aidaris.zc.bz IMMORTAL (Malware_Distribution)"; content:"|07|aidaris|02|zc|02|bz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630212; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup almightybusiness.co.in IMMORTAL (Malware_Distribution)"; content:"|10|almightybusiness|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619726; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup apogeecleaning.com IMMORTAL (Malware_Distribution)"; content:"|0e|apogeecleaning|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619741; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup arak.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|04|arak|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619744; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup baeisa.co.cc IMMORTAL (Malware_Distribution)"; content:"|06|baeisa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630213; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup baidustatz.com IMMORTAL (Malware_Distribution)"; content:"|0a|baidustatz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630214; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bb4msg.com IMMORTAL (Malware_Distribution)"; content:"|06|bb4msg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619763; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bliman.com IMMORTAL (Malware_Distribution)"; content:"|06|bliman|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630546; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brookewhitemedia.com IMMORTAL (Malware_Distribution)"; content:"|10|brookewhitemedia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619787; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cavaliersales.com IMMORTAL (Malware_Distribution)"; content:"|0d|cavaliersales|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619794; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup classicgamingcruises.com IMMORTAL (Malware_Distribution)"; content:"|14|classicgamingcruises|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619797; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup club-fx.ru IMMORTAL (Malware_Distribution)"; content:"|07|club-fx|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630560; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freeguard.biz IMMORTAL (Malware_Distribution)"; content:"|09|freeguard|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619841; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gabiweb.com IMMORTAL (Malware_Distribution)"; content:"|07|gabiweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630780; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-analyze.org IMMORTAL (Malware_Distribution)"; content:"|0e|google-analyze|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619856; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-newbot.cn IMMORTAL (Malware_Distribution)"; content:"|0d|google-newbot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630263; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup horasan.bel.tr IMMORTAL (Malware_Distribution)"; content:"|07|horasan|03|bel|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619892; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imapkolkata.com IMMORTAL (Malware_Distribution)"; content:"|0b|imapkolkata|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619898; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lisac2009.info IMMORTAL (Malware_Distribution)"; content:"|09|lisac2009|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619927; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup money2008.org IMMORTAL (Malware_Distribution)"; content:"|09|money2008|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620312; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup musicmufta.com IMMORTAL (Malware_Distribution)"; content:"|0a|musicmufta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619954; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup naijapress.com IMMORTAL (Malware_Distribution)"; content:"|0a|naijapress|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619957; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newtransfer.cn IMMORTAL (Malware_Distribution)"; content:"|0b|newtransfer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624920; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup onlinedetect.com IMMORTAL (Malware_Distribution)"; content:"|0c|onlinedetect|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624589; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup our-children.net IMMORTAL (Malware_Distribution)"; content:"|0c|our-children|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619974; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup plustecpk.com IMMORTAL (Malware_Distribution)"; content:"|09|plustecpk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619977; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rattanaburihos.com IMMORTAL (Malware_Distribution)"; content:"|0e|rattanaburihos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619990; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rockdog.ru IMMORTAL (Malware_Distribution)"; content:"|07|rockdog|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620847; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup s216344386.online.de IMMORTAL (Malware_Distribution)"; content:"|0a|s216344386|06|online|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620006; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sp.sk IMMORTAL (Malware_Distribution)"; content:"|02|sp|02|sk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620040; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sragenlor.com IMMORTAL (Malware_Distribution)"; content:"|09|sragenlor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620048; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vyshnya.pp.ua IMMORTAL (Malware_Distribution)"; content:"|07|vyshnya|02|pp|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620125; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yescounter.com IMMORTAL (Malware_Distribution)"; content:"|0a|yescounter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629514; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 2roonoodle.net IMMORTAL (Malware_Distribution)"; content:"|0a|2roonoodle|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620719; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigbossindia.net IMMORTAL (Malware_Distribution)"; content:"|0c|bigbossindia|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620476; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cnnomers.com IMMORTAL (Malware_Distribution)"; content:"|08|cnnomers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630976; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dennisvalentine.com IMMORTAL (Malware_Distribution)"; content:"|0f|dennisvalentine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620750; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fuskerbytes.com IMMORTAL (Malware_Distribution)"; content:"|0b|fuskerbytes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620758; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup intermaterials.net IMMORTAL (Malware_Distribution)"; content:"|0e|intermaterials|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630794; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup minpoo.com IMMORTAL (Malware_Distribution)"; content:"|06|minpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631639; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup stripsen.dk IMMORTAL (Malware_Distribution)"; content:"|08|stripsen|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620668; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup geniewebtest.co.uk IMMORTAL (Malware_Infectors)"; content:"|0c|geniewebtest|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630584; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup betheo.com IMMORTAL (Malware_Distribution)"; content:"|06|betheo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620474; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hama-soft.com IMMORTAL (Malware_Distribution)"; content:"|09|hama-soft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621002; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup awmmagazine.ru IMMORTAL (Malware_Distribution)"; content:"|0b|awmmagazine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630741; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rtjhteyjtyjtyj.orge.pl IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0e|rtjhteyjtyjtyj|04|orge|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630674; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 888758.com IMMORTAL (Fake_AV)"; content:"|06|888758|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625527; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a-cipher.com IMMORTAL (Malware_Distribution)"; content:"|08|a-cipher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630731; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup booblegum5.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|booblegum5|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630547; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yaruluytut.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|yaruluytut|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630518; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup entertainments-mp3-online.com IMMORTAL (Malware_Distribution)"; content:"|19|entertainments-mp3-online|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620528; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup grillonet.com.br IMMORTAL (Malware_Distribution)"; content:"|09|grillonet|03|com|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620552; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vemmanederland.nl IMMORTAL (Malware_Distribution)"; content:"|0e|vemmanederland|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620686; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yalovasehri.com IMMORTAL (Malware_Distribution)"; content:"|0b|yalovasehri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622917; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup talkio.com IMMORTAL (Malware_Infectors)"; content:"|06|talkio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630874; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gumentha.com IMMORTAL (SEO_Fraud)"; content:"|08|gumentha|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620553; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup avinashdeoskar.com IMMORTAL (Malware_Infectors)"; content:"|0e|avinashdeoskar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630101; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ladenas938.com IMMORTAL (Malware_Infectors)"; content:"|0a|ladenas938|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630274; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mfradio.lx.ro IMMORTAL (Malware_Infectors)"; content:"|07|mfradio|02|lx|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621054; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mustafahorasan.com IMMORTAL (Malware_Infectors)"; content:"|0e|mustafahorasan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621065; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sunsetstampede.org IMMORTAL (Malware_Infectors)"; content:"|0e|sunsetstampede|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620863; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup werbnjudr.co.cc IMMORTAL (Malware_Infectors)"; content:"|09|werbnjudr|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630896; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gmp32.org IMMORTAL (Malware_Distribution)"; content:"|05|gmp32|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620548; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup n-age.net IMMORTAL (Malware_Distribution)"; content:"|05|n-age|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2647133; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup piast-poland.com IMMORTAL (Malware_Distribution)"; content:"|0c|piast-poland|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627498; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hotel-sas.ru IMMORTAL (Malware_Distribution)"; content:"|09|hotel-sas|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629009; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ferhatkaraca.com IMMORTAL (Malware_Distribution)"; content:"|0c|ferhatkaraca|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628998; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blackjackcardcounting.co.uk IMMORTAL (Malware_Distribution)"; content:"|15|blackjackcardcounting|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628963; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup addthiss.net IMMORTAL (Malware_Distribution)"; content:"|08|addthiss|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624596; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup agasi-story.info IMMORTAL (Malware_Distribution)"; content:"|0b|agasi-story|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632397; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup akyoma.com IMMORTAL (Malware_Distribution)"; content:"|06|akyoma|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632290; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup areasdm.com.ar IMMORTAL (Malware_Distribution)"; content:"|07|areasdm|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627913; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup beza.tu2.ru IMMORTAL (Malware_Distribution)"; content:"|04|beza|03|tu2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619774; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bmplaces.msk.ru IMMORTAL (Malware_Distribution)"; content:"|08|bmplaces|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627579; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup carlossalina.com.ar IMMORTAL (Malware_Distribution)"; content:"|0c|carlossalina|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628527; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cipayroll.com IMMORTAL (Malware_Distribution)"; content:"|09|cipayroll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631471; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup coiffure-claude.com IMMORTAL (Malware_Distribution)"; content:"|0f|coiffure-claude|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628530; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cosmoabc.com IMMORTAL (Malware_Distribution)"; content:"|08|cosmoabc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627541; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dailylaiken.com IMMORTAL (Malware_Distribution)"; content:"|0b|dailylaiken|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627819; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup damisystem.com IMMORTAL (Malware_Distribution)"; content:"|0a|damisystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627770; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup escorialescorial.com IMMORTAL (Malware_Distribution)"; content:"|10|escorialescorial|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632082; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fajowe.ovh.org IMMORTAL (Malware_Distribution)"; content:"|06|fajowe|03|ovh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632292; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fauxtastic.net IMMORTAL (Malware_Distribution)"; content:"|0a|fauxtastic|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628115; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ff-traditions.com IMMORTAL (Malware_Distribution)"; content:"|0d|ff-traditions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632294; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fnyoga.biz IMMORTAL (Malware_Distribution)"; content:"|06|fnyoga|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632295; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup foto-retuse.cz IMMORTAL (Malware_Distribution)"; content:"|0b|foto-retuse|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632296; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fotoris.co.kr IMMORTAL (Malware_Distribution)"; content:"|07|fotoris|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632297; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup free-birthday-party.com IMMORTAL (Malware_Distribution)"; content:"|13|free-birthday-party|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628498; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gnci-ict.com IMMORTAL (Malware_Distribution)"; content:"|08|gnci-ict|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632301; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gozites.com IMMORTAL (Malware_Distribution)"; content:"|07|gozites|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628410; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup huileargane.com IMMORTAL (Malware_Distribution)"; content:"|0b|huileargane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628547; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup invincible72.com IMMORTAL (Malware_Distribution)"; content:"|0c|invincible72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632305; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kaplanoyunaletleri.com IMMORTAL (Malware_Distribution)"; content:"|12|kaplanoyunaletleri|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628505; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lupitaarmas.com IMMORTAL (Malware_Distribution)"; content:"|0b|lupitaarmas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628423; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup medyasehir.com IMMORTAL (Malware_Distribution)"; content:"|0a|medyasehir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627778; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mitroc.com IMMORTAL (Malware_Distribution)"; content:"|06|mitroc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628599; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mukertvaros.hu IMMORTAL (Malware_Distribution)"; content:"|0b|mukertvaros|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632221; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nakoncu.superhost.pl IMMORTAL (Malware_Distribution)"; content:"|07|nakoncu|09|superhost|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632330; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newufuq.com IMMORTAL (Malware_Distribution)"; content:"|07|newufuq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632222; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nextgenengineer.org IMMORTAL (Malware_Distribution)"; content:"|0f|nextgenengineer|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619366; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup obtkayukhlak.com IMMORTAL (Malware_Distribution)"; content:"|0c|obtkayukhlak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619377; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oxnard.la IMMORTAL (Malware_Distribution)"; content:"|06|oxnard|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632340; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oxxxi.com IMMORTAL (Malware_Distribution)"; content:"|05|oxxxi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632341; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oyunzadem.com IMMORTAL (Malware_Distribution)"; content:"|09|oyunzadem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619388; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ozguvenplastik.com IMMORTAL (Malware_Distribution)"; content:"|0e|ozguvenplastik|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628107; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pakptc.com IMMORTAL (Malware_Distribution)"; content:"|06|pakptc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632342; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup posgame.com IMMORTAL (Malware_Distribution)"; content:"|07|posgame|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619422; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup projectland.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|projectland|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619432; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup psplanet.com.au IMMORTAL (Malware_Distribution)"; content:"|08|psplanet|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619439; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup puppetpalace.nl IMMORTAL (Malware_Distribution)"; content:"|0c|puppetpalace|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631844; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qddlbd.com IMMORTAL (Malware_Distribution)"; content:"|06|qddlbd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619444; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rks1.de IMMORTAL (Malware_Distribution)"; content:"|04|rks1|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627676; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rxgenerics.net IMMORTAL (Malware_Distribution)"; content:"|0a|rxgenerics|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628446; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sarvodayachildcare.com IMMORTAL (Malware_Distribution)"; content:"|12|sarvodayachildcare|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628448; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shoremill.com IMMORTAL (Malware_Distribution)"; content:"|09|shoremill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632355; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup showkurve.de IMMORTAL (Malware_Distribution)"; content:"|09|showkurve|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632356; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shreeramrealestate.com IMMORTAL (Malware_Distribution)"; content:"|12|shreeramrealestate|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632357; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sinsaengtech.com IMMORTAL (Malware_Distribution)"; content:"|0c|sinsaengtech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620028; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sis-street.com IMMORTAL (Malware_Distribution)"; content:"|0a|sis-street|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632358; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sitec-med.com IMMORTAL (Malware_Distribution)"; content:"|09|sitec-med|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620029; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sitemaps.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|sitemaps|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629522; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup skzart.com IMMORTAL (Malware_Distribution)"; content:"|06|skzart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620031; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup surbhisoft.com IMMORTAL (Malware_Distribution)"; content:"|0a|surbhisoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620055; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tallestbuildingslist.com IMMORTAL (Malware_Distribution)"; content:"|14|tallestbuildingslist|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620067; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tejasindia.com IMMORTAL (Malware_Distribution)"; content:"|0a|tejasindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620071; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eva-marine.info IMMORTAL (Malware_Distribution)"; content:"|0a|eva-marine|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634231; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup extra-service.info IMMORTAL (Malware_Distribution)"; content:"|0d|extra-service|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634232; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tzv-stats.info IMMORTAL (Malware_Distribution)"; content:"|09|tzv-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634297; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alexblane.com IMMORTAL (Spyware)"; content:"|09|alexblane|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634151; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yeryeshsdhdhjfdhj.vv.cc IMMORTAL (Phishing_and_Theft)"; content:"|11|yeryeshsdhdhjfdhj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632748; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bdelles.com IMMORTAL (Malware_Distribution)"; content:"|07|bdelles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620471; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestcv.ro IMMORTAL (Malware_Distribution)"; content:"|06|bestcv|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620701; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tradeservise.com IMMORTAL (Malware_Distribution)"; content:"|0c|tradeservise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620424; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1x.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619556; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5t.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619597; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x0a.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619620; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x0q.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619623; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8b.in IMMORTAL (Malware_Distribution)"; content:"|03|x8b|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619641; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8b.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619642; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ediltermo.com IMMORTAL (Malware_Distribution)"; content:"|09|ediltermo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624854; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freewebtown.com IMMORTAL (Malware_Distribution)"; content:"|0b|freewebtown|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627736; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 1brd.kz IMMORTAL (Malware_Distribution)"; content:"|04|1brd|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626112; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 39b.ru IMMORTAL (Malware_Distribution)"; content:"|03|39b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619207; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup abdulabah.cn IMMORTAL (Malware_Distribution)"; content:"|09|abdulabah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623745; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adserv.cn IMMORTAL (Malware_Infectors)"; content:"|06|adserv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619697; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c5p.ru IMMORTAL (Malware_Distribution)"; content:"|03|c5p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624835; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c7r.ru IMMORTAL (Malware_Distribution)"; content:"|03|c7r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup craprofe.evoconcept.net IMMORTAL (Malware_Distribution)"; content:"|08|craprofe|0a|evoconcept|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628386; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ddl2.pl IMMORTAL (Malware_Distribution)"; content:"|04|ddl2|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628389; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup elantrasantrope.ru IMMORTAL (Malware_Distribution)"; content:"|0f|elantrasantrope|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630246; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hepberaberiz.net IMMORTAL (Malware_Distribution)"; content:"|0c|hepberaberiz|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629008; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jitoshaadi.com IMMORTAL (Malware_Distribution)"; content:"|0a|jitoshaadi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626210; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup joperty.net IMMORTAL (Malware_Distribution)"; content:"|07|joperty|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624885; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup livertip.com IMMORTAL (Malware_Distribution)"; content:"|08|livertip|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625818; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup maximumesystem.com IMMORTAL (Malware_Distribution)"; content:"|0e|maximumesystem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624907; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup minisearch.co.kr IMMORTAL (Malware_Distribution)"; content:"|0a|minisearch|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619949; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mix-plus.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|mix-plus|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633000; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ns10-wistee.fr IMMORTAL (Malware_Distribution)"; content:"|0b|ns10-wistee|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619968; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ottomansguild.com IMMORTAL (Malware_Distribution)"; content:"|0d|ottomansguild|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629036; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup street-info.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0b|street-info|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627921; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup trainings4u.com IMMORTAL (Malware_Distribution)"; content:"|0b|trainings4u|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629066; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup truemini.co.cc IMMORTAL (Malware_Distribution)"; content:"|08|truemini|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629503; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup waistor.com IMMORTAL (Malware_Distribution)"; content:"|07|waistor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626534; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zajimavost.cz IMMORTAL (Malware_Distribution)"; content:"|0a|zajimavost|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625851; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup atesterzi.com IMMORTAL (Malware_Distribution)"; content:"|09|atesterzi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633078; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup axa3.cn IMMORTAL (Malware_Distribution)"; content:"|04|axa3|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632398; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup busheyframingservices.co.uk IMMORTAL (Malware_Distribution)"; content:"|15|busheyframingservices|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630104; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup chriseden73.free.fr IMMORTAL (Malware_Distribution)"; content:"|0b|chriseden73|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632951; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dsms.in IMMORTAL (Malware_Distribution)"; content:"|04|dsms|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632423; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hirodomain.com IMMORTAL (Malware_Distribution)"; content:"|0a|hirodomain|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632193; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jejushinshin.co.kr IMMORTAL (Malware_Distribution)"; content:"|0c|jejushinshin|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632984; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mariosflyingpizzaclearlake.com IMMORTAL (Malware_Distribution)"; content:"|1a|mariosflyingpizzaclearlake|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632320; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup moonlightw.mireene.com IMMORTAL (Malware_Distribution)"; content:"|0a|moonlightw|07|mireene|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632218; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup muslimhands.org.sd IMMORTAL (Malware_Distribution)"; content:"|0b|muslimhands|03|org|02|sd"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631506; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup patriots4ai.com IMMORTAL (Malware_Distribution)"; content:"|0b|patriots4ai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632499; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup razumtds.ws IMMORTAL (Malware_Distribution)"; content:"|08|razumtds|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632513; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sabnorway.com IMMORTAL (Malware_Distribution)"; content:"|09|sabnorway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631516; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wizu.webd.pl IMMORTAL (Malware_Distribution)"; content:"|04|wizu|04|webd|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632262; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8u.in IMMORTAL (Malware_Distribution)"; content:"|03|x8u|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619650; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8u.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619651; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9d.in IMMORTAL (Malware_Distribution)"; content:"|03|x9d|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619654; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zaduheljtw.ru IMMORTAL (Malware_Distribution)"; content:"|0a|zaduheljtw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632383; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zxsoftpromo.ru IMMORTAL (Malware_Distribution)"; content:"|0b|zxsoftpromo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632385; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup trafficforalz.org IMMORTAL (Malware_Distribution)"; content:"|0d|trafficforalz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624016; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alcobro.net IMMORTAL (Malware_Distribution)"; content:"|07|alcobro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646653; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cattww.com IMMORTAL (Malware_Distribution)"; content:"|06|cattww|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631469; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup curem.net IMMORTAL (Malware_Distribution)"; content:"|05|curem|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646946; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup description2011.ru IMMORTAL (Malware_Distribution)"; content:"|0f|description2011|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636173; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u4anz.co.cc IMMORTAL (Malware_Distribution)"; content:"|05|u4anz|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627174; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zenrumor.ru IMMORTAL (Malware_Distribution)"; content:"|08|zenrumor|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625456; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bumin.org IMMORTAL (Malware_Distribution)"; content:"|05|bumin|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622951; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup strikeallow.ru IMMORTAL (Malware_Distribution)"; content:"|0b|strikeallow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625429; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup uxqt.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|uxqt|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633549; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vauzdftjok.ru IMMORTAL (Spyware)"; content:"|0a|vauzdftjok|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633193; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup busderaskon.com IMMORTAL (Malware_Infectors)"; content:"|0b|busderaskon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622952; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fotothhi.be IMMORTAL (Malware_Distribution)"; content:"|08|fotothhi|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620259; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup web-antivirus023.com IMMORTAL (Fake_AV)"; content:"|10|web-antivirus023|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625642; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xbl.kz IMMORTAL (Malware_Distribution)"; content:"|03|xbl|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619667; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ilsearch.com IMMORTAL (Malware_Infectors)"; content:"|08|ilsearch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623026; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vernonmusic.com IMMORTAL (Spyware)"; content:"|0b|vernonmusic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624794; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mypoints.kr IMMORTAL (Malware_Distribution)"; content:"|08|mypoints|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620315; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0j.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619983; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xq1.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619688; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xq8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619689; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 9966.org IMMORTAL (Malware_Distribution)"; content:"|04|9966|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617431; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tartonion.ru IMMORTAL (Malware_Distribution)"; content:"|09|tartonion|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620674; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f8a.ru IMMORTAL (Malware_Distribution)"; content:"|03|f8a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619831; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup florinlelcu.lx.ro IMMORTAL (Malware_Infectors)"; content:"|0b|florinlelcu|02|lx|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630118; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup restaurantinsuranceonthego.com IMMORTAL (Malware_Infectors)"; content:"|1a|restaurantinsuranceonthego|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630323; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup richlandproperties.ca IMMORTAL (Malware_Infectors)"; content:"|12|richlandproperties|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630324; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup delzzerro.cn IMMORTAL (Malware_Distribution)"; content:"|09|delzzerro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632787; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gengblogger.com IMMORTAL (Malware_Distribution)"; content:"|0b|gengblogger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626626; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jjangq.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|jjangq|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626638; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freehotgay.com IMMORTAL (Malware_Distribution)"; content:"|0a|freehotgay|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632808; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nanovoice.ru IMMORTAL (Malware_Distribution)"; content:"|09|nanovoice|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625143; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup viranti.ru IMMORTAL (Malware_Distribution)"; content:"|07|viranti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625201; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xenoncenter.com IMMORTAL (Malware_Distribution)"; content:"|0b|xenoncenter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620165; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup online-stats201.info IMMORTAL (Malware_Distribution)"; content:"|0f|online-stats201|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634271; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup depenam.com IMMORTAL (Malware_Distribution)"; content:"|07|depenam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623186; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fishum.com IMMORTAL (Malware_Distribution)"; content:"|06|fishum|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623198; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wiggete.com IMMORTAL (Malware_Distribution)"; content:"|07|wiggete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623322; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsdgsdhsh.vv.cc IMMORTAL (Malware_Distribution)"; content:"|09|gsdgsdhsh|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 18dd.net IMMORTAL (Malware_Distribution)"; content:"|04|18dd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632387; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xxxtoolbar.com IMMORTAL (Malware_Infectors)"; content:"|0a|xxxtoolbar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2601512; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goooogleadsence.biz IMMORTAL (Malware_Distribution)"; content:"|0f|goooogleadsence|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622699; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imgeshacks.net IMMORTAL (Malware_Distribution)"; content:"|0a|imgeshacks|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624879; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup parohiabunavestirebelu.go.ro IMMORTAL (Malware_Distribution)"; content:"|16|parohiabunavestirebelu|02|go|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628878; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sjmsvmttc.org IMMORTAL (Malware_Distribution)"; content:"|09|sjmsvmttc|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624967; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup studioai.kr IMMORTAL (Malware_Distribution)"; content:"|08|studioai|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624972; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tynyturi.com IMMORTAL (Malware_Distribution)"; content:"|08|tynyturi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624987; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup urinoor.com IMMORTAL (Malware_Distribution)"; content:"|07|urinoor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624990; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wenmo.in IMMORTAL (Malware_Distribution)"; content:"|05|wenmo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625003; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wwwtraff.com IMMORTAL (Malware_Distribution)"; content:"|08|wwwtraff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625006; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gvppjnjv.net.in IMMORTAL (Malware_Distribution)"; content:"|08|gvppjnjv|03|net|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634396; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup helphomecare.at IMMORTAL (SEO_Fraud)"; content:"|0c|helphomecare|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624684; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup livelnternet.net IMMORTAL (Malware_Distribution)"; content:"|0c|livelnternet|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620799; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vvvvc.co.cc IMMORTAL (Malware_Distribution)"; content:"|05|vvvvc|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632558; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup allspade.ru IMMORTAL (Malware_Distribution)"; content:"|08|allspade|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625032; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fitblues.ru IMMORTAL (Malware_Distribution)"; content:"|08|fitblues|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625306; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hairyplant.ru IMMORTAL (Malware_Distribution)"; content:"|0a|hairyplant|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625323; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup idealsword.ru IMMORTAL (Malware_Distribution)"; content:"|0a|idealsword|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625333; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup superiot.ru IMMORTAL (Malware_Distribution)"; content:"|08|superiot|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625435; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 2-kolka.pl IMMORTAL (Malware_Distribution)"; content:"|07|2-kolka|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625249; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup asfirey.net IMMORTAL (Malware_Distribution)"; content:"|07|asfirey|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625260; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup directsupershop.com IMMORTAL (Malware_Distribution)"; content:"|0f|directsupershop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625292; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup drugfreecard.info IMMORTAL (Malware_Distribution)"; content:"|0c|drugfreecard|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625295; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup esntionlatino.com IMMORTAL (Malware_Distribution)"; content:"|0d|esntionlatino|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625297; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kauzliten.com IMMORTAL (Malware_Distribution)"; content:"|09|kauzliten|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625350; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lineacount.info IMMORTAL (Malware_Distribution)"; content:"|0a|lineacount|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621545; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mywowtv.org IMMORTAL (Malware_Distribution)"; content:"|07|mywowtv|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625368; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup swayam.co.uk IMMORTAL (Malware_Distribution)"; content:"|06|swayam|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625437; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jetztvorun.net IMMORTAL (Malware_Infectors)"; content:"|0a|jetztvorun|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623034; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jookest.in IMMORTAL (Malware_Infectors)"; content:"|07|jookest|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623036; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup opperlant.com IMMORTAL (Malware_Infectors)"; content:"|09|opperlant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624511; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup virtuellvorun.org IMMORTAL (Malware_Infectors)"; content:"|0d|virtuellvorun|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623113; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oughwa.com IMMORTAL (Malware_Infectors)"; content:"|06|oughwa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621385; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup euy0.co.cc IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|04|euy0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634386; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jeelex.net IMMORTAL (Malware_Infectors)"; content:"|06|jeelex|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621019; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gate4ads.info IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|08|gate4ads|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628407; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup general-st.info IMMORTAL (Malware_Distribution)"; content:"|0a|general-st|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632439; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zoid.in IMMORTAL (Malware_Distribution)"; content:"|04|zoid|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626819; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-stats49.info IMMORTAL (Malware_Infectors)"; content:"|0e|google-stats49|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624133; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup multi-stats.info IMMORTAL (Malware_Infectors)"; content:"|0b|multi-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633943; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zanfo.it IMMORTAL (Malware_Distribution)"; content:"|05|zanfo|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631546; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup redpoo.com IMMORTAL (Malware_Infectors)"; content:"|06|redpoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626031; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup online-counter.cn IMMORTAL (Malware_Distribution)"; content:"|0e|online-counter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620410; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-analytlcs.com IMMORTAL (Malware_Distribution)"; content:"|10|google-analytlcs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625805; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup greatliteautobest.cn IMMORTAL (Malware_Distribution)"; content:"|11|greatliteautobest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625807; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup z360.net IMMORTAL (Malware_Distribution)"; content:"|04|z360|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633845; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup googleanalytlcs.net IMMORTAL (Malware_Distribution)"; content:"|0f|googleanalytlcs|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625806; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup grepad.com IMMORTAL (Malware_Infectors)"; content:"|06|grepad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625808; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup treplikon.com IMMORTAL (Malware_Distribution)"; content:"|09|treplikon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625844; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wowtribes.com IMMORTAL (Malware_Distribution)"; content:"|09|wowtribes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622710; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yougoodvideo.net IMMORTAL (Malware_Distribution)"; content:"|0c|yougoodvideo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623124; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3x.ro IMMORTAL (Malware_Distribution)"; content:"|02|3x|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626743; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup huil.in IMMORTAL (Malware_Distribution)"; content:"|04|huil|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623509; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup v00d00.org IMMORTAL (Malware_Distribution)"; content:"|06|v00d00|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627705; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 4safe.in IMMORTAL (Malware_Distribution)"; content:"|05|4safe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619703; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aimauto.org IMMORTAL (Malware_Distribution)"; content:"|07|aimauto|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628946; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup allnaturalpornstars.com IMMORTAL (Malware_Distribution)"; content:"|13|allnaturalpornstars|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628095; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup annuairemedicaloran.com IMMORTAL (Malware_Distribution)"; content:"|13|annuairemedicaloran|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628950; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup anyscent.ru IMMORTAL (SEO_Fraud)"; content:"|08|anyscent|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626744; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup arsenalforum.cekuj.net IMMORTAL (Malware_Distribution)"; content:"|0c|arsenalforum|05|cekuj|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628953; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup beachhub.info IMMORTAL (Malware_Distribution)"; content:"|08|beachhub|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619767; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestmortgagefind.cn IMMORTAL (Malware_Distribution)"; content:"|10|bestmortgagefind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626749; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup daddybigtop.cn IMMORTAL (Malware_Distribution)"; content:"|0b|daddybigtop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624050; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dionneg.com IMMORTAL (Malware_Distribution)"; content:"|07|dionneg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629422; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup diretctrishta.com IMMORTAL (Malware_Distribution)"; content:"|0d|diretctrishta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629423; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eskuvoiszalon.hu IMMORTAL (Malware_Distribution)"; content:"|0d|eskuvoiszalon|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628536; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fastbusinessleads.com IMMORTAL (Malware_Distribution)"; content:"|11|fastbusinessleads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629118; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup grizzli-counter.com IMMORTAL (Malware_Distribution)"; content:"|0f|grizzli-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633564; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup guppypetshop.com IMMORTAL (Malware_Distribution)"; content:"|0c|guppypetshop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619887; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hugetopnonfat.cn IMMORTAL (Malware_Distribution)"; content:"|0d|hugetopnonfat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624052; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kandrarkkm.org IMMORTAL (Malware_Distribution)"; content:"|0a|kandrarkkm|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629447; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup knuenglish.co.kr IMMORTAL (Malware_Distribution)"; content:"|0a|knuenglish|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628306; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lotbetworld.cn IMMORTAL (Malware_Distribution)"; content:"|0b|lotbetworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624054; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup millionsdream.cn IMMORTAL (Malware_Distribution)"; content:"|0d|millionsdream|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup namestorevideo.cn IMMORTAL (Malware_Distribution)"; content:"|0e|namestorevideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625826; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nt04.in IMMORTAL (Malware_Distribution)"; content:"|04|nt04|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623248; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup peskostruikaz.com IMMORTAL (Malware_Distribution)"; content:"|0d|peskostruikaz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622391; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pioneers-online.co.in IMMORTAL (Malware_Distribution)"; content:"|0f|pioneers-online|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626477; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup placeforfun.nl IMMORTAL (Malware_Distribution)"; content:"|0b|placeforfun|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628883; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rsequitytips.com IMMORTAL (Malware_Distribution)"; content:"|0c|rsequitytips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620001; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup saba-ac.com IMMORTAL (Malware_Distribution)"; content:"|07|saba-ac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620008; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup social-stats.info IMMORTAL (Malware_Distribution)"; content:"|0c|social-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629187; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup testossteron.ru IMMORTAL (Malware_Distribution)"; content:"|0c|testossteron|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629500; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup topaylar.com.tr IMMORTAL (Malware_Distribution)"; content:"|08|topaylar|03|com|02|tr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629502; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ymcakorea.org IMMORTAL (Malware_Distribution)"; content:"|09|ymcakorea|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620169; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup youngorfabric.com IMMORTAL (Malware_Distribution)"; content:"|0d|youngorfabric|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628928; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zeroclan.net IMMORTAL (Malware_Distribution)"; content:"|08|zeroclan|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620176; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zymkasi.com IMMORTAL (Malware_Distribution)"; content:"|07|zymkasi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620386; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aikyu.ru IMMORTAL (SEO_Fraud)"; content:"|05|aikyu|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620388; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alisa-carter.com IMMORTAL (Malware_Distribution)"; content:"|0c|alisa-carter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634022; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup betstarwager.cn IMMORTAL (Malware_Distribution)"; content:"|0c|betstarwager|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629235; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup escribaniaquinterno.com.ar IMMORTAL (Malware_Distribution)"; content:"|13|escribaniaquinterno|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620531; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup game163.in IMMORTAL (Malware_Distribution)"; content:"|07|game163|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635635; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iqckly.ru IMMORTAL (SEO_Fraud)"; content:"|06|iqckly|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620285; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup parktadimrestaurant.com IMMORTAL (Malware_Distribution)"; content:"|13|parktadimrestaurant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620619; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup query-google.com IMMORTAL (Malware_Distribution)"; content:"|0c|query-google|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633013; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup reberi.com IMMORTAL (Malware_Distribution)"; content:"|06|reberi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620842; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup trafdriver.com IMMORTAL (Malware_Distribution)"; content:"|0a|trafdriver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620681; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup naty.org IMMORTAL (Malware_Distribution)"; content:"|04|naty|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628253; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup novustvnet.com IMMORTAL (Malware_Distribution)"; content:"|0a|novustvnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620324; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup storyfold.info IMMORTAL (Malware_Distribution)"; content:"|09|storyfold|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624047; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ar-kirm.ru IMMORTAL (Fake_AV)"; content:"|07|ar-kirm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625758; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup piupiu7.co.cc IMMORTAL (Fake_AV)"; content:"|07|piupiu7|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627104; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup islamwelt.ch IMMORTAL (Malware_Distribution)"; content:"|09|islamwelt|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629825; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lingamcabs.com IMMORTAL (Malware_Distribution)"; content:"|0a|lingamcabs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620575; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nemohuildiin.ru IMMORTAL (Malware_Infectors)"; content:"|0c|nemohuildiin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620610; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tenthprofit.ru IMMORTAL (Malware_Distribution)"; content:"|0b|tenthprofit|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627155; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wtopcompany.biz IMMORTAL (Malware_Distribution)"; content:"|0b|wtopcompany|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626817; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ankursociety.org IMMORTAL (Malware_Infectors)"; content:"|0c|ankursociety|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622721; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup inartdesigns.com IMMORTAL (Botnet_C&C)"; content:"|0c|inartdesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623731; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup its-email.co.uk IMMORTAL (Botnet_C&C)"; content:"|09|its-email|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623732; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lasur8e.com IMMORTAL (Malware_Infectors)"; content:"|07|lasur8e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626108; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup muddbowl.com IMMORTAL (Malware_Infectors)"; content:"|08|muddbowl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622817; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nordamerika-invest.com IMMORTAL (Malware_Infectors)"; content:"|12|nordamerika-invest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622826; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pills.ind.in IMMORTAL (Spyware)"; content:"|05|pills|03|ind|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622159; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup unb0rn.biz IMMORTAL (Malware_Infectors)"; content:"|06|unb0rn|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624056; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup modinali.com IMMORTAL (Malware_Distribution)"; content:"|08|modinali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627319; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtopescorts.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bigtopescorts|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624049; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup recover88888.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0c|recover88888|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625838; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup abugyhe.cn IMMORTAL (Malware_Distribution)"; content:"|07|abugyhe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623747; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup afyopku.cn IMMORTAL (Malware_Distribution)"; content:"|07|afyopku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623748; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ahukyh.cn IMMORTAL (Malware_Distribution)"; content:"|06|ahukyh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623749; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ajoibe.cn IMMORTAL (Malware_Distribution)"; content:"|06|ajoibe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623750; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup akaelyr.cn IMMORTAL (Malware_Distribution)"; content:"|07|akaelyr|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623751; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup akebuop.cn IMMORTAL (Malware_Distribution)"; content:"|07|akebuop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623752; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup akouzo.cn IMMORTAL (Malware_Distribution)"; content:"|06|akouzo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623753; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup amuejgo.cn IMMORTAL (Malware_Distribution)"; content:"|07|amuejgo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623757; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup anuyqve.cn IMMORTAL (Malware_Distribution)"; content:"|07|anuyqve|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623779; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup apuarym.cn IMMORTAL (Malware_Distribution)"; content:"|07|apuarym|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623780; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup axokawe.cn IMMORTAL (Malware_Distribution)"; content:"|07|axokawe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623794; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup botezsu.cn IMMORTAL (Malware_Distribution)"; content:"|07|botezsu|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ceqycfa.cn IMMORTAL (Malware_Distribution)"; content:"|07|ceqycfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623837; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ebyazro.cn IMMORTAL (Malware_Distribution)"; content:"|07|ebyazro|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623848; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup efoelug.cn IMMORTAL (Malware_Distribution)"; content:"|07|efoelug|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623850; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup egaxies.cn IMMORTAL (Malware_Distribution)"; content:"|07|egaxies|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623851; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup exezaho.cn IMMORTAL (Malware_Distribution)"; content:"|07|exezaho|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623854; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fizhox.cn IMMORTAL (Malware_Distribution)"; content:"|06|fizhox|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623856; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fyqtewa.cn IMMORTAL (Malware_Distribution)"; content:"|07|fyqtewa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623860; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goldrushphone.cn IMMORTAL (Malware_Distribution)"; content:"|0d|goldrushphone|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623864; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup handharmony.cn IMMORTAL (Malware_Distribution)"; content:"|0b|handharmony|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623868; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup havirfy.cn IMMORTAL (Malware_Distribution)"; content:"|07|havirfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623869; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jyzhaje.cn IMMORTAL (Malware_Distribution)"; content:"|07|jyzhaje|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623889; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lebisuf.cn IMMORTAL (Malware_Distribution)"; content:"|07|lebisuf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623897; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ligpeos.cn IMMORTAL (Malware_Distribution)"; content:"|07|ligpeos|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623899; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup linhaky.cn IMMORTAL (Malware_Distribution)"; content:"|07|linhaky|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623901; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup liqedjo.cn IMMORTAL (Malware_Distribution)"; content:"|07|liqedjo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623902; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup liwgabe.cn IMMORTAL (Malware_Distribution)"; content:"|07|liwgabe|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623904; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lovpiny.cn IMMORTAL (Malware_Distribution)"; content:"|07|lovpiny|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623906; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup luljeco.cn IMMORTAL (Malware_Distribution)"; content:"|07|luljeco|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623907; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup luqfeoh.cn IMMORTAL (Malware_Distribution)"; content:"|07|luqfeoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623908; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lytucak.cn IMMORTAL (Malware_Distribution)"; content:"|07|lytucak|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623909; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup misgyow.cn IMMORTAL (Malware_Distribution)"; content:"|07|misgyow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623912; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup myqvaic.cn IMMORTAL (Malware_Distribution)"; content:"|07|myqvaic|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623920; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup obejoys.cn IMMORTAL (Malware_Distribution)"; content:"|07|obejoys|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623923; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oloibge.cn IMMORTAL (Malware_Distribution)"; content:"|07|oloibge|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623924; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup omuahed.cn IMMORTAL (Malware_Distribution)"; content:"|07|omuahed|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623925; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup opyaxa.cn IMMORTAL (Malware_Distribution)"; content:"|06|opyaxa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623927; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pivozec.cn IMMORTAL (Malware_Distribution)"; content:"|07|pivozec|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623931; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qormyv.cn IMMORTAL (Malware_Distribution)"; content:"|06|qormyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623937; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup reviewsfinance.cn IMMORTAL (Malware_Distribution)"; content:"|0e|reviewsfinance|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623941; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup smilecourage.cn IMMORTAL (Malware_Distribution)"; content:"|0c|smilecourage|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624003; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tibemka.cn IMMORTAL (Malware_Distribution)"; content:"|07|tibemka|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624012; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup toolboxhome.cn IMMORTAL (Malware_Distribution)"; content:"|0b|toolboxhome|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624014; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ufouqib.cn IMMORTAL (Malware_Distribution)"; content:"|07|ufouqib|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624020; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ugolyxa.cn IMMORTAL (Malware_Distribution)"; content:"|07|ugolyxa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624021; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ukyfeuw.cn IMMORTAL (Malware_Distribution)"; content:"|07|ukyfeuw|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624023; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup urosina.cn IMMORTAL (Malware_Distribution)"; content:"|07|urosina|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624028; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wufimo.cn IMMORTAL (Malware_Distribution)"; content:"|06|wufimo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624031; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xicgoku.cn IMMORTAL (Malware_Distribution)"; content:"|07|xicgoku|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624033; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xojede.cn IMMORTAL (Malware_Distribution)"; content:"|06|xojede|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624034; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ycauqel.cn IMMORTAL (Malware_Distribution)"; content:"|07|ycauqel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624036; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ydugoh.cn IMMORTAL (Malware_Distribution)"; content:"|06|ydugoh|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624038; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zezmah.cn IMMORTAL (Malware_Distribution)"; content:"|06|zezmah|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624041; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zopyfa.cn IMMORTAL (Malware_Distribution)"; content:"|06|zopyfa|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624042; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zuchiom.cn IMMORTAL (Malware_Distribution)"; content:"|07|zuchiom|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624043; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0c|bestnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626750; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigbestfind.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigbestfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626751; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtopmanagement.cn IMMORTAL (Malware_Distribution)"; content:"|10|bigtopmanagement|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626754; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup securelive.co.kr IMMORTAL (Malware_Infectors)"; content:"|0a|securelive|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633022; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup scanlation.net IMMORTAL (Malware_Distribution)"; content:"|0a|scanlation|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631853; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup obscurewax.ru IMMORTAL (Malware_Distribution)"; content:"|0a|obscurewax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620612; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup secondgain.ru IMMORTAL (Malware_Distribution)"; content:"|0a|secondgain|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620656; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shortrib.ru IMMORTAL (Malware_Distribution)"; content:"|08|shortrib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620659; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup starvingarctic.ru IMMORTAL (Malware_Distribution)"; content:"|0e|starvingarctic|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620666; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-analystisc.com IMMORTAL (Malware_Distribution)"; content:"|11|google-analystisc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620550; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gigalife.info IMMORTAL (Malware_Distribution)"; content:"|08|gigalife|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626764; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goldmsc.info IMMORTAL (Malware_Distribution)"; content:"|07|goldmsc|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626766; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 000007.ru IMMORTAL (Malware_Distribution)"; content:"|06|000007|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626742; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x1v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x1v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619626; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup htresq.com IMMORTAL (Malware_Distribution)"; content:"|06|htresq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626774; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sunqtr.com IMMORTAL (Malware_Distribution)"; content:"|06|sunqtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622877; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ysbweb.com IMMORTAL (Malware_Distribution)"; content:"|06|ysbweb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2603300; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestfindaloan.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bestfindaloan|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626747; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigpremiumfind.cn IMMORTAL (Malware_Distribution)"; content:"|0e|bigpremiumfind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626752; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigskytopguide.cn IMMORTAL (Malware_Distribution)"; content:"|0e|bigskytopguide|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626753; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bablodos.com IMMORTAL (Malware_Distribution)"; content:"|08|bablodos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622041; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup solodov.in IMMORTAL (Malware_Infectors)"; content:"|07|solodov|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621386; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tds-info.net IMMORTAL (Malware_Infectors)"; content:"|08|tds-info|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621387; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 6600.org IMMORTAL (Malware_Distribution)"; content:"|04|6600|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610609; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 8800.org IMMORTAL (Malware_Distribution)"; content:"|04|8800|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610607; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 8866.org IMMORTAL (Malware_Distribution)"; content:"|04|8866|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610608; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alkte.com IMMORTAL (Malware_Distribution)"; content:"|05|alkte|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627536; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup deinglaube.com IMMORTAL (Malware_Distribution)"; content:"|0a|deinglaube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622697; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ixnitor.com IMMORTAL (Malware_Distribution)"; content:"|07|ixnitor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619910; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup printinstant.com IMMORTAL (Malware_Distribution)"; content:"|0c|printinstant|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619980; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sgviralscan.com IMMORTAL (Malware_Distribution)"; content:"|0b|sgviralscan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622704; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shtos.ru IMMORTAL (Malware_Distribution)"; content:"|05|shtos|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628108; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tagdol.dothome.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|tagdol|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620672; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup uin1.cn IMMORTAL (Malware_Distribution)"; content:"|04|uin1|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622706; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup uin2.cn IMMORTAL (Malware_Distribution)"; content:"|04|uin2|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622707; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 123kochi.com IMMORTAL (Malware_Distribution)"; content:"|08|123kochi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620439; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adwordanalitycs.ru IMMORTAL (SEO_Fraud)"; content:"|0f|adwordanalitycs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620387; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b-i-o-v.ru IMMORTAL (SEO_Fraud)"; content:"|07|b-i-o-v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620390; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bicodehl.com IMMORTAL (Malware_Distribution)"; content:"|08|bicodehl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636383; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brokersearch.co.za IMMORTAL (Malware_Distribution)"; content:"|0c|brokersearch|02|co|02|za"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629732; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup clickmeter.ru IMMORTAL (SEO_Fraud)"; content:"|0a|clickmeter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620702; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dedlife.ru IMMORTAL (SEO_Fraud)"; content:"|07|dedlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620395; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup doubleclickr.ru IMMORTAL (SEO_Fraud)"; content:"|0c|doubleclickr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620513; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iquotient.ru IMMORTAL (SEO_Fraud)"; content:"|09|iquotient|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620286; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup masturbacja.ovh.org IMMORTAL (Malware_Distribution)"; content:"|0b|masturbacja|03|ovh|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629833; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nexprice.com IMMORTAL (Malware_Distribution)"; content:"|08|nexprice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629841; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup plusbest.ru IMMORTAL (SEO_Fraud)"; content:"|08|plusbest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620705; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup raviganeshassociates.com IMMORTAL (Malware_Distribution)"; content:"|14|raviganeshassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620641; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup saeed-photo.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0b|saeed-photo|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620653; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup siteanalitycs.ru IMMORTAL (SEO_Fraud)"; content:"|0d|siteanalitycs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620706; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup srpskidespot.org.rs IMMORTAL (Malware_Distribution)"; content:"|0c|srpskidespot|03|org|02|rs"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620665; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup supersidecar.ru IMMORTAL (SEO_Fraud)"; content:"|0c|supersidecar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620708; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup testometr.ru IMMORTAL (SEO_Fraud)"; content:"|09|testometr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620709; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup theeasyriver.ru IMMORTAL (SEO_Fraud)"; content:"|0c|theeasyriver|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620710; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup timdizayn.ru IMMORTAL (Malware_Distribution)"; content:"|09|timdizayn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620349; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yahoosite.ru IMMORTAL (SEO_Fraud)"; content:"|09|yahoosite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620711; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zief.pl IMMORTAL (Malware_Infectors)"; content:"|04|zief|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2614058; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup h1.ripway.com IMMORTAL (Malware_Distribution)"; content:"|02|h1|06|ripway|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620771; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jx2dbtwg.com IMMORTAL (Malware_Distribution)"; content:"|08|jx2dbtwg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629658; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oooabterast0.co.cc IMMORTAL (Malware_Distribution)"; content:"|0c|oooabterast0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629678; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup websmeter.com IMMORTAL (Malware_Distribution)"; content:"|09|websmeter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620927; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qq12300.com IMMORTAL (Fake_AV)"; content:"|07|qq12300|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627119; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup golddeery.info IMMORTAL (Malware_Distribution)"; content:"|09|golddeery|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620549; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup litend.com IMMORTAL (Malware_Distribution)"; content:"|06|litend|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626780; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup skkedu.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|skkedu|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622867; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dlkasfgatker.com IMMORTAL (Malware_Infectors)"; content:"|0c|dlkasfgatker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628112; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kotopes.cn IMMORTAL (Malware_Infectors)"; content:"|07|kotopes|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621384; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pivfeels.com IMMORTAL (Spyware)"; content:"|08|pivfeels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628259; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 90000000.ru IMMORTAL (Malware_Infectors)"; content:"|08|90000000|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625853; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ads-t.ru IMMORTAL (Malware_Distribution)"; content:"|05|ads-t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620204; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cometruestar.ru IMMORTAL (Malware_Distribution)"; content:"|0c|cometruestar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622248; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup genuinecolors.ru IMMORTAL (Malware_Distribution)"; content:"|0d|genuinecolors|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622250; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup herangi.com IMMORTAL (Botnet_C&C)"; content:"|07|herangi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622251; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup madcmx.mx IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|06|madcmx|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620582; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mypersonalhttp.com IMMORTAL (Spyware)"; content:"|0e|mypersonalhttp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626789; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup usepetrol2earn.com IMMORTAL (Malware_Distribution)"; content:"|0e|usepetrol2earn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620105; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup reglasti.com IMMORTAL (Malware_Distribution)"; content:"|08|reglasti|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626796; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rokobon.com IMMORTAL (Malware_Infectors)"; content:"|07|rokobon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622254; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3322.org IMMORTAL (Malware_Distribution)"; content:"|04|3322|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2605536; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jkhteqa.com IMMORTAL (Malware_Distribution)"; content:"|07|jkhteqa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619913; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mybar.us IMMORTAL (Malware_Distribution)"; content:"|05|mybar|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619956; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup im.ne.kr IMMORTAL (Malware_Distribution)"; content:"|02|im|02|ne|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626822; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup parthsoft.com IMMORTAL (Malware_Distribution)"; content:"|09|parthsoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619396; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pinarlikoyu.com IMMORTAL (Malware_Distribution)"; content:"|0b|pinarlikoyu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619407; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup plmag.net IMMORTAL (Malware_Distribution)"; content:"|05|plmag|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619416; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pqshow.org IMMORTAL (Malware_Distribution)"; content:"|06|pqshow|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620831; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup se-group.de IMMORTAL (Malware_Distribution)"; content:"|08|se-group|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626986; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup seoshell.com IMMORTAL (Malware_Distribution)"; content:"|08|seoshell|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626989; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sonyericsson.lua.pl IMMORTAL (Malware_Distribution)"; content:"|0c|sonyericsson|03|lua|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631904; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup stats-master88.info IMMORTAL (Malware_Distribution)"; content:"|0e|stats-master88|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634280; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup stats-master99.info IMMORTAL (Malware_Distribution)"; content:"|0e|stats-master99|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634281; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup liagand.cn IMMORTAL (Malware_Distribution)"; content:"|07|liagand|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620573; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup augami.net IMMORTAL (Malware_Distribution)"; content:"|06|augami|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630403; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup olokedu.com IMMORTAL (Malware_Distribution)"; content:"|07|olokedu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630465; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup offiget.ru IMMORTAL (Malware_Distribution)"; content:"|07|offiget|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621562; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 114oldest.com IMMORTAL (Malware_Distribution)"; content:"|09|114oldest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629077; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alpine-balloon-challenge.ch IMMORTAL (Malware_Distribution)"; content:"|18|alpine-balloon-challenge|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619727; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goldtmv.info IMMORTAL (Malware_Distribution)"; content:"|07|goldtmv|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620767; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iaachamber.com IMMORTAL (Malware_Distribution)"; content:"|0a|iaachamber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623023; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup in-in.in IMMORTAL (Malware_Distribution)"; content:"|05|in-in|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626886; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup majnon313.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|majnon313|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629026; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup manafnet.com IMMORTAL (Malware_Distribution)"; content:"|08|manafnet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629028; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup marmaratriko.net IMMORTAL (Malware_Distribution)"; content:"|0c|marmaratriko|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629029; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup najbolja-zabava.com IMMORTAL (Malware_Distribution)"; content:"|0f|najbolja-zabava|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628669; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ngl.kr IMMORTAL (Malware_Distribution)"; content:"|03|ngl|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619965; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup obec.go.th IMMORTAL (Malware_Distribution)"; content:"|04|obec|02|go|02|th"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628435; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pennystock-picks.info IMMORTAL (Malware_Distribution)"; content:"|10|pennystock-picks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628880; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup plasmahdtvratings.com IMMORTAL (Malware_Distribution)"; content:"|11|plasmahdtvratings|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629040; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pmgkorea.com IMMORTAL (Malware_Distribution)"; content:"|08|pmgkorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629041; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup roomart.info IMMORTAL (Malware_Distribution)"; content:"|07|roomart|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629996; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ruooo.com IMMORTAL (Malware_Distribution)"; content:"|05|ruooo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629491; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup swissarmyknifes.us IMMORTAL (Malware_Distribution)"; content:"|0f|swissarmyknifes|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629059; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tattoo-h.com IMMORTAL (Malware_Distribution)"; content:"|08|tattoo-h|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628908; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup testilla.ru IMMORTAL (Malware_Distribution)"; content:"|08|testilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628651; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thaibadmintonclub.com IMMORTAL (Malware_Distribution)"; content:"|11|thaibadmintonclub|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629062; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup theatrekoodak.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0d|theatrekoodak|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629063; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tngthai.com IMMORTAL (Malware_Distribution)"; content:"|07|tngthai|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629064; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup w00d00pipls.net IMMORTAL (Malware_Distribution)"; content:"|0b|w00d00pipls|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630025; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup woo-gie.com IMMORTAL (Malware_Distribution)"; content:"|07|woo-gie|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629211; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup retireterrify.ru IMMORTAL (Malware_Infectors)"; content:"|0d|retireterrify|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625160; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup banan-service.org IMMORTAL (Malware_Distribution)"; content:"|0d|banan-service|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621189; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jkbioindia.com IMMORTAL (Malware_Distribution)"; content:"|0a|jkbioindia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620290; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup clicksor.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|08|clicksor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630414; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup date-me.ro IMMORTAL (Malware_Distribution)"; content:"|07|date-me|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630421; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup j5b.kr IMMORTAL (Malware_Distribution)"; content:"|03|j5b|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630443; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup serfinworld.com IMMORTAL (Malware_Distribution)"; content:"|0b|serfinworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621591; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gowardtor2010movie.co.cc IMMORTAL (Malware_Distribution)"; content:"|12|gowardtor2010movie|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623007; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup maharath.com IMMORTAL (Malware_Distribution)"; content:"|08|maharath|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623042; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qlke.ru IMMORTAL (Malware_Distribution)"; content:"|04|qlke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621579; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wordwacker.com IMMORTAL (Spyware)"; content:"|0a|wordwacker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622913; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cpuconsulting.co.cc IMMORTAL (Malware_Infectors)"; content:"|0d|cpuconsulting|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630109; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dualmenu.co.cc IMMORTAL (Malware_Infectors)"; content:"|08|dualmenu|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630114; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kolctg.com IMMORTAL (Malware_Infectors)"; content:"|06|kolctg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630144; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 12s83.com IMMORTAL (Malware_Distribution)"; content:"|05|12s83|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634017; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup semikemi.info IMMORTAL (Malware_Distribution)"; content:"|08|semikemi|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626697; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rijagt.dk IMMORTAL (Malware_Distribution)"; content:"|06|rijagt|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628270; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sanahr.com IMMORTAL (Malware_Distribution)"; content:"|06|sanahr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628513; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup allowstrike.ru IMMORTAL (Malware_Distribution)"; content:"|0b|allowstrike|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624613; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup awm-magazine.ru IMMORTAL (Malware_Distribution)"; content:"|0c|awm-magazine|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626116; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cassandrarice.com IMMORTAL (Malware_Distribution)"; content:"|0d|cassandrarice|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625017; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup countinfo.com IMMORTAL (Malware_Distribution)"; content:"|09|countinfo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626172; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup julyrelax.ru IMMORTAL (Malware_Distribution)"; content:"|09|julyrelax|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626215; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup magazineawm.ru IMMORTAL (Malware_Distribution)"; content:"|0b|magazineawm|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626229; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup traypro.ru IMMORTAL (Malware_Distribution)"; content:"|07|traypro|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626272; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tuta-anti.ru IMMORTAL (Malware_Distribution)"; content:"|09|tuta-anti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626275; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tutaanti.ru IMMORTAL (Malware_Distribution)"; content:"|08|tutaanti|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626276; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tutavir.ru IMMORTAL (Malware_Distribution)"; content:"|07|tutavir|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626277; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup visitthermal.ru IMMORTAL (Malware_Distribution)"; content:"|0c|visitthermal|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625204; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wizrd-enterteiment.ru IMMORTAL (Malware_Distribution)"; content:"|12|wizrd-enterteiment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626287; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wizrdenterteiment.ru IMMORTAL (Malware_Distribution)"; content:"|11|wizrdenterteiment|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626288; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aeaaea.com IMMORTAL (Malware_Distribution)"; content:"|06|aeaaea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622479; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup awaue.com IMMORTAL (Malware_Distribution)"; content:"|05|awaue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622485; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup berfry43bgrbf.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0d|berfry43bgrbf|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633231; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup euuaw.com IMMORTAL (Malware_Distribution)"; content:"|05|euuaw|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622521; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup g243gtdsgsdg.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0c|g243gtdsgsdg|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633260; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup glkgj5j4rshdfhj.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0f|glkgj5j4rshdfhj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633267; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gs34grsgdg.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0a|gs34grsgdg|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633271; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsdg3gsdgsdg.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0c|gsdg3gsdgsdg|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633273; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jfgdhdfhsdfh.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0c|jfgdhdfhsdfh|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633281; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jfgjfr5jdfj.vv.cc IMMORTAL (Malware_Infectors)"; content:"|0b|jfgjfr5jdfj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633282; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup secowo.com IMMORTAL (Malware_Distribution)"; content:"|06|secowo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622619; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup secree.com IMMORTAL (Malware_Distribution)"; content:"|06|secree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622620; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup uoauer.com IMMORTAL (Malware_Distribution)"; content:"|06|uoauer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622662; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-stat50.info IMMORTAL (Malware_Distribution)"; content:"|0d|google-stat50|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624679; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bedfer.com IMMORTAL (Malware_Distribution)"; content:"|06|bedfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624624; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup buypartylights.com IMMORTAL (Malware_Distribution)"; content:"|0e|buypartylights|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631465; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsdg2g32.co.cc IMMORTAL (Malware_Distribution)"; content:"|08|gsdg2g32|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633272; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hrh45jftjfj.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|hrh45jftjfj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633278; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jassportfolio.se IMMORTAL (Malware_Distribution)"; content:"|0d|jassportfolio|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631794; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jdownloaderitalia.netsons.org IMMORTAL (Malware_Distribution)"; content:"|11|jdownloaderitalia|07|netsons|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631795; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kiralikasansorizmir.com IMMORTAL (Malware_Distribution)"; content:"|13|kiralikasansorizmir|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645991; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kirm-sky.ru IMMORTAL (Malware_Distribution)"; content:"|08|kirm-sky|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625977; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kockoy.com IMMORTAL (Malware_Distribution)"; content:"|06|kockoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628102; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup loveaz.biz IMMORTAL (Malware_Distribution)"; content:"|06|loveaz|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631502; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pixforfree.net IMMORTAL (Malware_Distribution)"; content:"|0a|pixforfree|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619412; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup randomlegend.net IMMORTAL (Malware_Distribution)"; content:"|0c|randomlegend|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632083; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup scaraori.com IMMORTAL (Malware_Distribution)"; content:"|08|scaraori|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627361; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sexpot.co.kr IMMORTAL (Malware_Distribution)"; content:"|06|sexpot|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628643; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sgs.co.kr IMMORTAL (Malware_Distribution)"; content:"|03|sgs|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628516; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sho0oq.com IMMORTAL (Malware_Distribution)"; content:"|06|sho0oq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628469; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shoba.in IMMORTAL (Malware_Distribution)"; content:"|05|shoba|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620022; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup showdevelopment.com IMMORTAL (Malware_Distribution)"; content:"|0f|showdevelopment|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620025; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup squirrelbird.net IMMORTAL (Malware_Distribution)"; content:"|0c|squirrelbird|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620047; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup crazymasya.com IMMORTAL (Malware_Distribution)"; content:"|0a|crazymasya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623841; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup inlovebot.com IMMORTAL (Malware_Distribution)"; content:"|09|inlovebot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623876; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup smartenergymodel.com IMMORTAL (Malware_Infectors)"; content:"|10|smartenergymodel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627141; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup volgo-marun.cn IMMORTAL (Malware_Infectors)"; content:"|0b|volgo-marun|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627755; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup corpadsinc.com IMMORTAL (Malware_Infectors)"; content:"|0a|corpadsinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625230; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 212156dnfgdn.co.cc IMMORTAL (Phishing_and_Theft)"; content:"|0c|212156dnfgdn|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632574; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsdg43hsweh.co.cc IMMORTAL (Phishing_and_Theft)"; content:"|0b|gsdg43hsweh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632637; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hairyartist.ru IMMORTAL (Malware_Distribution)"; content:"|0b|hairyartist|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620556; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hndfdfnfdnxdnf.vv.cc IMMORTAL (Phishing_and_Theft)"; content:"|0e|hndfdfnfdnxdnf|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632653; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hu587tiugi.vv.cc IMMORTAL (Phishing_and_Theft)"; content:"|0a|hu587tiugi|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632655; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lonelyzero.ru IMMORTAL (Malware_Distribution)"; content:"|0a|lonelyzero|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620578; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup t6ryt56.info IMMORTAL (Spyware)"; content:"|07|t6ryt56|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634295; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup before-this-life.ru IMMORTAL (Malware_Distribution)"; content:"|10|before-this-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625015; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestage.ru IMMORTAL (Malware_Distribution)"; content:"|07|bestage|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625016; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestbondsite.ru IMMORTAL (Malware_Distribution)"; content:"|0c|bestbondsite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624820; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bio-age.ru IMMORTAL (Malware_Distribution)"; content:"|07|bio-age|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624823; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bio-free.ru IMMORTAL (Malware_Distribution)"; content:"|08|bio-free|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624824; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bio-oib.ru IMMORTAL (Malware_Distribution)"; content:"|07|bio-oib|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624825; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bio-tube.ru IMMORTAL (Malware_Distribution)"; content:"|08|bio-tube|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624826; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bio-z.ru IMMORTAL (Malware_Distribution)"; content:"|05|bio-z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624827; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup inother.ru IMMORTAL (Malware_Distribution)"; content:"|07|inother|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625022; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mozg-testing.ru IMMORTAL (Malware_Distribution)"; content:"|0c|mozg-testing|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625233; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mozgilla.ru IMMORTAL (Malware_Distribution)"; content:"|08|mozgilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625234; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pastanotherlife.ru IMMORTAL (Malware_Distribution)"; content:"|0f|pastanotherlife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625023; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup recentmexico.ru IMMORTAL (Malware_Distribution)"; content:"|0c|recentmexico|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626029; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup realtydesk.ru IMMORTAL (Malware_Distribution)"; content:"|0a|realtydesk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620645; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup onceworld.ru IMMORTAL (Malware_Distribution)"; content:"|09|onceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620409; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bradinfo.org IMMORTAL (Malware_Distribution)"; content:"|08|bradinfo|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628525; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtopstudios.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bigtopstudios|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633592; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup daebang.or.kr IMMORTAL (Malware_Distribution)"; content:"|07|daebang|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633724; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup e-ads-13.info IMMORTAL (Malware_Distribution)"; content:"|08|e-ads-13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633732; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup g23h2hfsdjh.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|g23h2hfsdjh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632811; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hdsh4hsfhdsj.vv.cc IMMORTAL (Malware_Distribution)"; content:"|0c|hdsh4hsfhdsj|02|vv|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632824; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hermosayasociados.com IMMORTAL (Malware_Distribution)"; content:"|11|hermosayasociados|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632826; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lustzucker.de IMMORTAL (Malware_Distribution)"; content:"|0a|lustzucker|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632844; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup malinowyzdroj.com.pl IMMORTAL (Malware_Distribution)"; content:"|0d|malinowyzdroj|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633776; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup paytraff.biz IMMORTAL (Malware_Distribution)"; content:"|08|paytraff|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633643; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup phones4wow.com IMMORTAL (Malware_Distribution)"; content:"|0a|phones4wow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633646; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup planutt.com IMMORTAL (Malware_Distribution)"; content:"|07|planutt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633795; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup raufkhalid.com IMMORTAL (Malware_Distribution)"; content:"|0a|raufkhalid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632871; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup usonlineguide.com IMMORTAL (Malware_Distribution)"; content:"|0d|usonlineguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633828; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xcounter.ru IMMORTAL (Malware_Distribution)"; content:"|08|xcounter|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632912; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goodgirlsbadguys.com IMMORTAL (Malware_Infectors)"; content:"|10|goodgirlsbadguys|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619140; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup calicutinternationalschool.com IMMORTAL (Malware_Distribution)"; content:"|1a|calicutinternationalschool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624783; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup marazmatik3.in IMMORTAL (Malware_Infectors)"; content:"|0b|marazmatik3|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627481; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 0catch.com IMMORTAL (Malware_Distribution)"; content:"|06|0catch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627028; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antivirusys.ru IMMORTAL (Fake_AV)"; content:"|0b|antivirusys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625756; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup benuoska.com IMMORTAL (Malware_Distribution)"; content:"|08|benuoska|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624625; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-server43.info IMMORTAL (Malware_Distribution)"; content:"|0f|google-server43|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620995; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mainnetsoll.com IMMORTAL (Malware_Distribution)"; content:"|0b|mainnetsoll|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625247; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tttaaattt.ru IMMORTAL (Malware_Distribution)"; content:"|09|tttaaattt|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624792; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vcp-counter.com IMMORTAL (Malware_Distribution)"; content:"|0b|vcp-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624793; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup findbigsoftpack.cn IMMORTAL (Malware_Distribution)"; content:"|0f|findbigsoftpack|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627060; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup giantpremium.cn IMMORTAL (Malware_Distribution)"; content:"|0c|giantpremium|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627200; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mchawking.com IMMORTAL (Malware_Infectors)"; content:"|09|mchawking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625108; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fancycake.net IMMORTAL (Malware_Infectors)"; content:"|09|fancycake|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621493; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 2all.net IMMORTAL (Malware_Distribution)"; content:"|04|2all|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626302; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 75a.net IMMORTAL (Malware_Distribution)"; content:"|03|75a|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628517; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 772268.com IMMORTAL (Malware_Distribution)"; content:"|06|772268|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625519; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 77276.com IMMORTAL (Malware_Distribution)"; content:"|05|77276|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613354; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adverter13.info IMMORTAL (Malware_Distribution)"; content:"|0a|adverter13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622277; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ajantastationers.com IMMORTAL (Malware_Distribution)"; content:"|10|ajantastationers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626317; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup allforyouonline.com IMMORTAL (Malware_Distribution)"; content:"|0f|allforyouonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632934; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup balatoninyelvitabor.eu IMMORTAL (Malware_Distribution)"; content:"|13|balatoninyelvitabor|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626325; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtopfindsite.cn IMMORTAL (Malware_Distribution)"; content:"|0e|bigtopfindsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627037; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blackoutday.ca IMMORTAL (Malware_Distribution)"; content:"|0b|blackoutday|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628806; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blog-salopes.com IMMORTAL (Malware_Distribution)"; content:"|0c|blog-salopes|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626332; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bloggingforprofitsecrets.com IMMORTAL (Malware_Distribution)"; content:"|18|bloggingforprofitsecrets|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626333; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup centatu.com IMMORTAL (Malware_Distribution)"; content:"|07|centatu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626160; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup china-saws.com IMMORTAL (Malware_Distribution)"; content:"|0a|china-saws|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630555; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup counnter.cn IMMORTAL (Malware_Distribution)"; content:"|08|counnter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624585; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dasharathbhagat.com IMMORTAL (Malware_Distribution)"; content:"|0f|dasharathbhagat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628692; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup domain460009.com IMMORTAL (Malware_Distribution)"; content:"|0c|domain460009|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624846; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup efradin.net IMMORTAL (Malware_Distribution)"; content:"|07|efradin|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626410; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup egyptfoods.com.eg IMMORTAL (Malware_Distribution)"; content:"|0a|egyptfoods|03|com|02|eg"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626412; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup electroncompany.ro IMMORTAL (Malware_Distribution)"; content:"|0f|electroncompany|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626416; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ezadguf.net IMMORTAL (Malware_Distribution)"; content:"|07|ezadguf|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622330; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ezgmp.com IMMORTAL (Malware_Distribution)"; content:"|05|ezgmp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628495; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fancountblogger.com IMMORTAL (Malware_Distribution)"; content:"|0f|fancountblogger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625801; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ferefr.com IMMORTAL (Malware_Distribution)"; content:"|06|ferefr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630579; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fgnfdfthrv.bee.pl IMMORTAL (Malware_Distribution)"; content:"|0a|fgnfdfthrv|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626426; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup filthyadserver.com IMMORTAL (Malware_Distribution)"; content:"|0e|filthyadserver|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626193; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freepetcaretips.com IMMORTAL (Malware_Distribution)"; content:"|0f|freepetcaretips|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619842; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup g4teilt.de IMMORTAL (Malware_Distribution)"; content:"|07|g4teilt|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626196; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gate4clicks.info IMMORTAL (Spyware)"; content:"|0b|gate4clicks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625081; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup globalmixgroup.cn IMMORTAL (Malware_Distribution)"; content:"|0e|globalmixgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627067; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup globalnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0e|globalnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627068; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goldtmu.info IMMORTAL (Malware_Distribution)"; content:"|07|goldtmu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620766; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup habrion.cn IMMORTAL (Malware_Distribution)"; content:"|07|habrion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625809; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hadamilano.com IMMORTAL (Malware_Distribution)"; content:"|0a|hadamilano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626437; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hadishop.ir IMMORTAL (Malware_Distribution)"; content:"|08|hadishop|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626198; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup harborlab.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|harborlab|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626438; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hope2012.info IMMORTAL (Malware_Distribution)"; content:"|08|hope2012|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622346; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup inexper.com IMMORTAL (Malware_Distribution)"; content:"|07|inexper|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622352; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup innovativepoly.com.au IMMORTAL (Malware_Distribution)"; content:"|0e|innovativepoly|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626204; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup intzvill.com IMMORTAL (Malware_Distribution)"; content:"|08|intzvill|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619905; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jinchunmarket.co.kr IMMORTAL (Malware_Distribution)"; content:"|0d|jinchunmarket|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626208; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup joymineralcosmetics.com IMMORTAL (Malware_Distribution)"; content:"|13|joymineralcosmetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628117; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup junaidandzia.com IMMORTAL (Malware_Distribution)"; content:"|0c|junaidandzia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632987; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kavur.com IMMORTAL (Malware_Distribution)"; content:"|05|kavur|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625812; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kebsyno.com IMMORTAL (Malware_Distribution)"; content:"|07|kebsyno|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622356; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kirmar.ru IMMORTAL (Malware_Distribution)"; content:"|06|kirmar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626221; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lageny.com IMMORTAL (Malware_Distribution)"; content:"|06|lageny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626447; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup liteautogreatest.cn IMMORTAL (Malware_Distribution)"; content:"|10|liteautogreatest|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624587; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lojadasflores.pt IMMORTAL (Malware_Distribution)"; content:"|0d|lojadasflores|02|pt"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624904; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lsjrs.com IMMORTAL (Malware_Distribution)"; content:"|05|lsjrs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626453; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lubnays.cn IMMORTAL (Malware_Distribution)"; content:"|07|lubnays|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622808; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup machineclassic.com IMMORTAL (Malware_Distribution)"; content:"|0e|machineclassic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622809; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mainoffer4you.com IMMORTAL (Malware_Distribution)"; content:"|0d|mainoffer4you|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626454; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup manatki-moda.ru IMMORTAL (Malware_Distribution)"; content:"|0c|manatki-moda|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626455; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup marchingbaby.com IMMORTAL (Malware_Distribution)"; content:"|0c|marchingbaby|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632999; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mediahousenamebuyvideo.cn IMMORTAL (Malware_Distribution)"; content:"|16|mediahousenamebuyvideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630627; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup miracledialer.com IMMORTAL (Malware_Distribution)"; content:"|0d|miracledialer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626238; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mjw.or.kr IMMORTAL (Malware_Distribution)"; content:"|03|mjw|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628428; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup moviecoupons.com IMMORTAL (Malware_Distribution)"; content:"|0c|moviecoupons|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628429; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mysterio.info IMMORTAL (Malware_Distribution)"; content:"|08|mysterio|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624914; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nameclaimstore.cn IMMORTAL (Malware_Distribution)"; content:"|0e|nameclaimstore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625824; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nameforshop.cn IMMORTAL (Malware_Distribution)"; content:"|0b|nameforshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625825; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup naveli.com IMMORTAL (Malware_Distribution)"; content:"|06|naveli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625145; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup networkvoicepromos.com IMMORTAL (Malware_Distribution)"; content:"|12|networkvoicepromos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628871; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nt02.co.in IMMORTAL (Malware_Distribution)"; content:"|04|nt02|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619969; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nuclear3.com IMMORTAL (Malware_Distribution)"; content:"|08|nuclear3|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626671; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup peopleopera.cn IMMORTAL (Malware_Distribution)"; content:"|0b|peopleopera|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624590; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pms.com.au IMMORTAL (Malware_Distribution)"; content:"|03|pms|03|com|02|au"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626243; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup postfolkovs.ru IMMORTAL (Malware_Distribution)"; content:"|0b|postfolkovs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627745; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup premiumgolfmart.com IMMORTAL (Malware_Distribution)"; content:"|0f|premiumgolfmart|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626684; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pwgegrsdfs.ru IMMORTAL (Malware_Distribution)"; content:"|0a|pwgegrsdfs|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622842; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0a.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619540; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rantrafrout.com IMMORTAL (Spyware)"; content:"|0b|rantrafrout|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631369; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup redirect-script.com IMMORTAL (Malware_Distribution)"; content:"|0f|redirect-script|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628641; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup riotassistance.ru IMMORTAL (Malware_Distribution)"; content:"|0e|riotassistance|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620845; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rslinkgenerator.com IMMORTAL (Malware_Distribution)"; content:"|0f|rslinkgenerator|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627126; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup saspoo.com IMMORTAL (Malware_Distribution)"; content:"|06|saspoo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626691; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup secretstocredit.com IMMORTAL (Malware_Distribution)"; content:"|0f|secretstocredit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628893; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sedfer.com IMMORTAL (Malware_Distribution)"; content:"|06|sedfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626988; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup send29931.cn IMMORTAL (Malware_Distribution)"; content:"|09|send29931|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633023; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sglazu.net IMMORTAL (Malware_Distribution)"; content:"|06|sglazu|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629493; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shindigz.info IMMORTAL (Malware_Distribution)"; content:"|08|shindigz|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626250; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup simonis-web.org IMMORTAL (Malware_Distribution)"; content:"|0b|simonis-web|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626516; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sochi.nov.ru IMMORTAL (Malware_Distribution)"; content:"|05|sochi|03|nov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628061; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup soulinyou.ru IMMORTAL (Malware_Distribution)"; content:"|09|soulinyou|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622427; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup spacecake.se IMMORTAL (Malware_Distribution)"; content:"|09|spacecake|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627749; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup stats-master11.info IMMORTAL (Malware_Distribution)"; content:"|0e|stats-master11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626521; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup taijijuan.ru IMMORTAL (Malware_Distribution)"; content:"|09|taijijuan|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630698; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup teleam.com IMMORTAL (Malware_Distribution)"; content:"|06|teleam|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625843; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thelotmachine.cn IMMORTAL (Malware_Distribution)"; content:"|0d|thelotmachine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627158; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thenetnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0e|thenetnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627159; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup totaldid.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|totaldid|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627167; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tradbox.net IMMORTAL (Malware_Distribution)"; content:"|07|tradbox|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622897; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tvoyatajna.msk.ru IMMORTAL (Malware_Distribution)"; content:"|0a|tvoyatajna|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626278; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup verfer.com IMMORTAL (Malware_Distribution)"; content:"|06|verfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626528; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup virgilrene.info IMMORTAL (Malware_Distribution)"; content:"|0a|virgilrene|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625847; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vsmd.kz IMMORTAL (Malware_Distribution)"; content:"|04|vsmd|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627756; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup webarh.com IMMORTAL (Malware_Distribution)"; content:"|06|webarh|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627188; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup witcobber.com IMMORTAL (Malware_Distribution)"; content:"|09|witcobber|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626286; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup worldtruejournal.biz IMMORTAL (Malware_Distribution)"; content:"|10|worldtruejournal|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624334; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xedfer.com IMMORTAL (Malware_Distribution)"; content:"|06|xedfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626541; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yalovacimenemlak.com IMMORTAL (Malware_Distribution)"; content:"|10|yalovacimenemlak|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625009; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yourinsurancenow.info IMMORTAL (Malware_Distribution)"; content:"|10|yourinsurancenow|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628929; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yourlitetop.cn IMMORTAL (Malware_Distribution)"; content:"|0b|yourlitetop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627195; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yourpic.msk.ru IMMORTAL (Malware_Distribution)"; content:"|07|yourpic|03|msk|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625651; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup baxfer.com IMMORTAL (Malware_Distribution)"; content:"|06|baxfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625772; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kevfer.com IMMORTAL (Malware_Distribution)"; content:"|06|kevfer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625814; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup etnkorea.com IMMORTAL (Malware_Distribution)"; content:"|08|etnkorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626599; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kert9qw2.com IMMORTAL (Malware_Distribution)"; content:"|08|kert9qw2|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626641; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 000cc.com IMMORTAL (Malware_Distribution)"; content:"|05|000cc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620714; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 13grandferi.ru IMMORTAL (Malware_Distribution)"; content:"|0b|13grandferi|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632084; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 360doc.com IMMORTAL (Malware_Distribution)"; content:"|06|360doc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632576; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3f4.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619225; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 9365.org IMMORTAL (Malware_Distribution)"; content:"|04|9365|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632579; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adscomplete.info IMMORTAL (Malware_Distribution)"; content:"|0b|adscomplete|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632095; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup advabnr.com IMMORTAL (Malware_Distribution)"; content:"|07|advabnr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634309; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alltuckedinathome.com IMMORTAL (Malware_Distribution)"; content:"|11|alltuckedinathome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631559; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup am4u.kr IMMORTAL (Malware_Distribution)"; content:"|04|am4u|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631445; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antistresser.com IMMORTAL (Malware_Distribution)"; content:"|0c|antistresser|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632937; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup atlasbicycles.com IMMORTAL (Malware_Distribution)"; content:"|0d|atlasbicycles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630737; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup baragas-budd1.com IMMORTAL (Malware_Distribution)"; content:"|0d|baragas-budd1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633471; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup battop.ru IMMORTAL (Malware_Infectors)"; content:"|06|battop|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625014; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bedioger.com IMMORTAL (Malware_Distribution)"; content:"|08|bedioger|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650754; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bevelli.com IMMORTAL (Malware_Distribution)"; content:"|07|bevelli|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632949; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bunssang.com IMMORTAL (Malware_Distribution)"; content:"|08|bunssang|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620482; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ctpatconsultants.com IMMORTAL (Malware_Distribution)"; content:"|10|ctpatconsultants|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628493; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fashionnails1.com IMMORTAL (Malware_Distribution)"; content:"|0d|fashionnails1|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632293; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup forredtag.ru IMMORTAL (Malware_Infectors)"; content:"|09|forredtag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625231; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup framtr.com IMMORTAL (Malware_Distribution)"; content:"|06|framtr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636438; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freepornii.com IMMORTAL (Malware_Distribution)"; content:"|0a|freepornii|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633258; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fuadrenal.com IMMORTAL (Malware_Distribution)"; content:"|09|fuadrenal|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2650784; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup genuinehollywood.ru IMMORTAL (Malware_Infectors)"; content:"|10|genuinehollywood|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625021; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gharibola.ru IMMORTAL (Malware_Distribution)"; content:"|09|gharibola|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632186; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gogo2me.net IMMORTAL (Malware_Distribution)"; content:"|07|gogo2me|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629275; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hotnewguide.ru IMMORTAL (Malware_Infectors)"; content:"|0b|hotnewguide|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625087; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup internetcountercheck.com IMMORTAL (Malware_Distribution)"; content:"|14|internetcountercheck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620564; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup landriver44.ru IMMORTAL (Malware_Distribution)"; content:"|0b|landriver44|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632995; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup latebin.ru IMMORTAL (Malware_Distribution)"; content:"|07|latebin|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633507; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup listage.info IMMORTAL (Malware_Distribution)"; content:"|07|listage|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633145; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup livench.com IMMORTAL (Malware_Distribution)"; content:"|07|livench|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620800; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup livesitedesign.ru IMMORTAL (Malware_Infectors)"; content:"|0e|livesitedesign|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625232; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup m85853.com.cn IMMORTAL (Malware_Distribution)"; content:"|06|m85853|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633146; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup martuz.cn IMMORTAL (Malware_Distribution)"; content:"|06|martuz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632674; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mediatagonline.ru IMMORTAL (Malware_Infectors)"; content:"|0e|mediatagonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625109; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup misfitsone.net IMMORTAL (Malware_Distribution)"; content:"|0a|misfitsone|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622581; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mnogobab.com IMMORTAL (Malware_Distribution)"; content:"|08|mnogobab|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629561; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup n85853.cn IMMORTAL (Malware_Distribution)"; content:"|06|n85853|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633159; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nakedbi.com IMMORTAL (Malware_Distribution)"; content:"|07|nakedbi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632329; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newagedirect.ru IMMORTAL (Malware_Infectors)"; content:"|0c|newagedirect|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625147; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup odile-marco.com IMMORTAL (Malware_Distribution)"; content:"|0b|odile-marco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632925; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oeooea.com IMMORTAL (Malware_Distribution)"; content:"|06|oeooea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622590; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup onlyfind.net IMMORTAL (Malware_Distribution)"; content:"|08|onlyfind|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629562; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pocketbloke.ru IMMORTAL (Malware_Distribution)"; content:"|0b|pocketbloke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621570; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rnw.kz IMMORTAL (Malware_Distribution)"; content:"|03|rnw|02|kz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629995; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup robertsaffiliatsprograms.net IMMORTAL (Malware_Distribution)"; content:"|18|robertsaffiliatsprograms|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631665; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shopmovieproduction.cn IMMORTAL (Malware_Distribution)"; content:"|13|shopmovieproduction|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633027; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sina163.info IMMORTAL (Malware_Distribution)"; content:"|07|sina163|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633173; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sswelder.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|sswelder|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633175; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup supermicrotag.ru IMMORTAL (Malware_Infectors)"; content:"|0d|supermicrotag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625239; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thelifetag.ru IMMORTAL (Malware_Infectors)"; content:"|0a|thelifetag|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625241; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ustocn.com.cn IMMORTAL (Malware_Distribution)"; content:"|06|ustocn|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633189; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zkasbo.ru IMMORTAL (Malware_Distribution)"; content:"|06|zkasbo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633056; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup durnosy.com IMMORTAL (Malware_Infectors)"; content:"|07|durnosy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623844; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sevenseasexplorer.de IMMORTAL (Malware_Infectors)"; content:"|11|sevenseasexplorer|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622622; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sparkspk.com IMMORTAL (Malware_Infectors)"; content:"|08|sparkspk|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624733; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thanhhoacpi.vn IMMORTAL (Malware_Infectors)"; content:"|0b|thanhhoacpi|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633543; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup base-jump.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|base-jump|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622042; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hipsxpress.co.uk IMMORTAL (Malware_Distribution)"; content:"|0a|hipsxpress|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622100; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lernundsnej.com IMMORTAL (Malware_Distribution)"; content:"|0b|lernundsnej|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626648; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup profincorp.com IMMORTAL (Malware_Distribution)"; content:"|0a|profincorp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621576; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup quality4service.com IMMORTAL (Malware_Distribution)"; content:"|0f|quality4service|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622173; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yandex-click.net IMMORTAL (Malware_Distribution)"; content:"|0c|yandex-click|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622238; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imagequest360.com IMMORTAL (Malware_Distribution)"; content:"|0d|imagequest360|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628502; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup furniture-style.info IMMORTAL (Malware_Distribution)"; content:"|0f|furniture-style|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624586; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yahoo-statistic.com IMMORTAL (Malware_Distribution)"; content:"|0f|yahoo-statistic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624775; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup g2hhfadh4ehfdh.co.cc IMMORTAL (Malware_Infectors)"; content:"|0e|g2hhfadh4ehfdh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633261; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gdsg23gsgf.co.cc IMMORTAL (Malware_Infectors)"; content:"|0a|gdsg23gsgf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633490; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup agreatindian.com IMMORTAL (Fake_AV)"; content:"|0c|agreatindian|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625692; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aibsnleachq.in IMMORTAL (Fake_AV)"; content:"|0b|aibsnleachq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625696; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cqww88.com IMMORTAL (Fake_AV)"; content:"|06|cqww88|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626379; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cxgglm.com IMMORTAL (Fake_AV)"; content:"|06|cxgglm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625566; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup desktop-xp.com IMMORTAL (Fake_AV)"; content:"|0a|desktop-xp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626394; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup digitalnames.net IMMORTAL (Fake_AV)"; content:"|0c|digitalnames|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618948; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup enterteiment-wizrd.ru IMMORTAL (Fake_AV)"; content:"|12|enterteiment-wizrd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626419; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup enterteimentwizrd.ru IMMORTAL (Fake_AV)"; content:"|11|enterteimentwizrd|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626420; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup everywoods.ru IMMORTAL (Fake_AV)"; content:"|0a|everywoods|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626600; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup filmojid.com IMMORTAL (Fake_AV)"; content:"|08|filmojid|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626610; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gaja79.com IMMORTAL (Fake_AV)"; content:"|06|gaja79|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626621; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup loaninfoslive.com IMMORTAL (Fake_AV)"; content:"|0d|loaninfoslive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626922; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup palliativepoonoor.org IMMORTAL (Fake_AV)"; content:"|11|palliativepoonoor|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626966; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup smarttorich.com IMMORTAL (Fake_AV)"; content:"|0b|smarttorich|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627143; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tecros.ru IMMORTAL (Fake_AV)"; content:"|06|tecros|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627151; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thesiterush.com IMMORTAL (Fake_AV)"; content:"|0b|thesiterush|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627161; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tinypic.info IMMORTAL (Fake_AV)"; content:"|07|tinypic|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627164; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ukad.com IMMORTAL (Fake_AV)"; content:"|04|ukad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625632; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup toolbarinc.com IMMORTAL (Malware_Infectors)"; content:"|0a|toolbarinc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627166; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vdsvps.in IMMORTAL ()"; content:"|06|vdsvps|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633045; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup todosantivirusfree.com IMMORTAL (Fake_AV)"; content:"|12|todosantivirusfree|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633672; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup amcupsite.com IMMORTAL (Malware_Distribution)"; content:"|09|amcupsite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622720; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dianesomerville.co.uk IMMORTAL (Malware_Distribution)"; content:"|0f|dianesomerville|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622513; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kmqwe.in IMMORTAL (Malware_Distribution)"; content:"|05|kmqwe|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623895; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 32tsdgseg.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|32tsdgseg|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632088; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ad100sdhjsd.com IMMORTAL (Malware_Distribution)"; content:"|0b|ad100sdhjsd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620957; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bacalawr.net IMMORTAL (Malware_Distribution)"; content:"|08|bacalawr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625261; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dullplane.ru IMMORTAL (Malware_Distribution)"; content:"|09|dullplane|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622516; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eftpsid0343233.ru IMMORTAL (Malware_Distribution)"; content:"|0e|eftpsid0343233|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626411; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup finlinkonline.com IMMORTAL (Malware_Distribution)"; content:"|0d|finlinkonline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622528; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freepicturebox.com IMMORTAL (Malware_Distribution)"; content:"|0e|freepicturebox|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625927; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-stats44.info IMMORTAL (Malware_Distribution)"; content:"|0e|google-stats44|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625315; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-stats55.info IMMORTAL (Malware_Distribution)"; content:"|0e|google-stats55|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625317; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hahablaururu.info IMMORTAL (Malware_Distribution)"; content:"|0c|hahablaururu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622542; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hbaehanfznjfh.co.cc IMMORTAL (Malware_Distribution)"; content:"|0d|hbaehanfznjfh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632972; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hdh45hdxfhf.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|hdh45hdxfhf|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632647; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hottiger.ru IMMORTAL (Malware_Distribution)"; content:"|08|hottiger|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625088; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup joiojojo.in IMMORTAL (Malware_Distribution)"; content:"|08|joiojojo|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626212; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kai-zellner.de IMMORTAL (Malware_Distribution)"; content:"|0b|kai-zellner|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620569; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup statistics-cyberpank.co.cc IMMORTAL (Malware_Distribution)"; content:"|14|statistics-cyberpank|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622635; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xatarena.com IMMORTAL (Malware_Distribution)"; content:"|08|xatarena|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626097; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mediahousenamemartmovie.cn IMMORTAL (Malware_Infectors)"; content:"|17|mediahousenamemartmovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626785; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup domsre.com IMMORTAL (Malware_Distribution)"; content:"|06|domsre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621469; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup faimpazzireiragazzi.it IMMORTAL (Malware_Distribution)"; content:"|13|faimpazzireiragazzi|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634016; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kjep.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|kjep|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626642; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rthrwndda.bee.pl IMMORTAL (Malware_Distribution)"; content:"|09|rthrwndda|03|bee|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624729; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup textcube.com IMMORTAL (Malware_Distribution)"; content:"|08|textcube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621129; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 128bitninja.com IMMORTAL (Malware_Distribution)"; content:"|0b|128bitninja|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622713; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup analys.ru IMMORTAL (Malware_Distribution)"; content:"|06|analys|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627937; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ardsigorta.com IMMORTAL (Malware_Distribution)"; content:"|0a|ardsigorta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622724; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigclarks.com IMMORTAL (Malware_Distribution)"; content:"|09|bigclarks|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625274; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup clifedo.net IMMORTAL (Malware_Distribution)"; content:"|07|clifedo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622747; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup farbaby.ru IMMORTAL (Malware_Distribution)"; content:"|07|farbaby|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622766; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gberbhjerfds.osa.pl IMMORTAL (Malware_Distribution)"; content:"|0c|gberbhjerfds|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625935; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gstats.cn IMMORTAL (Malware_Distribution)"; content:"|06|gstats|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622788; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hit-senders.cn IMMORTAL (Malware_Distribution)"; content:"|0b|hit-senders|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622794; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iexam.info IMMORTAL (Malware_Distribution)"; content:"|05|iexam|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627739; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imgdownloads.com IMMORTAL (Malware_Distribution)"; content:"|0c|imgdownloads|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622797; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup natebennettfleming.com IMMORTAL (Malware_Distribution)"; content:"|12|natebennettfleming|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup neglite.com IMMORTAL (Malware_Distribution)"; content:"|07|neglite|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622822; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup seemoreshows.com IMMORTAL (Malware_Distribution)"; content:"|0c|seemoreshows|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622860; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sepi.tw IMMORTAL (Malware_Distribution)"; content:"|04|sepi|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622862; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup theherbfarm.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|theherbfarm|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620679; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup web-counter-online.ru IMMORTAL (Malware_Distribution)"; content:"|12|web-counter-online|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625444; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yadr0.com IMMORTAL (Malware_Distribution)"; content:"|05|yadr0|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622916; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yasarsigorta.com IMMORTAL (Malware_Distribution)"; content:"|0c|yasarsigorta|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625450; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imgaaa.net IMMORTAL (Malware_Infectors)"; content:"|06|imgaaa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635696; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lbook.org IMMORTAL (Malware_Distribution)"; content:"|05|lbook|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622360; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup new.weincorping.info IMMORTAL (Malware_Infectors)"; content:"|03|new|0b|weincorping|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625598; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ediyhy.cn IMMORTAL (Malware_Distribution)"; content:"|06|ediyhy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619815; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ajytse5.com IMMORTAL (Malware_Infectors)"; content:"|07|ajytse5|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625703; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alf.inf.br IMMORTAL (Malware_Infectors)"; content:"|03|alf|03|inf|02|br"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625715; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dimsmoke.ru IMMORTAL (Malware_Distribution)"; content:"|08|dimsmoke|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624383; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goldcoinurl.com IMMORTAL (Malware_Infectors)"; content:"|0b|goldcoinurl|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625804; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goog1e-analytics.com IMMORTAL (Malware_Infectors)"; content:"|10|goog1e-analytics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627627; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup greatrow.ru IMMORTAL (Malware_Distribution)"; content:"|08|greatrow|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624425; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup littlecommon.net IMMORTAL (Malware_Infectors)"; content:"|0c|littlecommon|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624786; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup podgorz.org IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|07|podgorz|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627744; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ppcube.com IMMORTAL (Malware_Infectors)"; content:"|06|ppcube|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621315; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup redrt.org.in IMMORTAL (Spyware)"; content:"|05|redrt|03|org|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622176; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thingre.com IMMORTAL (Malware_Distribution)"; content:"|07|thingre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620081; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tiredwolfhome.com IMMORTAL (Spyware)"; content:"|0d|tiredwolfhome|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627782; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tourskorea.com IMMORTAL (Malware_Distribution)"; content:"|0a|tourskorea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628654; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup translate-google-cache.com IMMORTAL (Malware_Infectors)"; content:"|16|translate-google-cache|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627783; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup videoowatch.co.tv IMMORTAL (Malware_Infectors)"; content:"|0b|videoowatch|02|co|02|tv"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626079; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup web-antivirus021.com IMMORTAL (Fake_AV)"; content:"|10|web-antivirus021|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625641; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup windowshopworld.com IMMORTAL (Malware_Infectors)"; content:"|0f|windowshopworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622462; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wwwzapas.cn IMMORTAL (Malware_Distribution)"; content:"|08|wwwzapas|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620148; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imgddd.net IMMORTAL (Malware_Distribution)"; content:"|06|imgddd|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636450; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup paleenem.com IMMORTAL (Malware_Distribution)"; content:"|08|paleenem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626793; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup scornar.com IMMORTAL (Malware_Distribution)"; content:"|07|scornar|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626798; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup theboehringers.com IMMORTAL (Spyware)"; content:"|0e|theboehringers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624791; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antispy-online90.com IMMORTAL (Fake_AV)"; content:"|10|antispy-online90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625223; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antispyware-online90.com IMMORTAL (Fake_AV)"; content:"|14|antispyware-online90|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625224; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antivirus-online21.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online21|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625225; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antivirus-online31.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online31|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625226; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antivirus-online51.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online51|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625227; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup antivirus-online71.com IMMORTAL (Fake_AV)"; content:"|12|antivirus-online71|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625228; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lovegreenstreet.com IMMORTAL (Spyware)"; content:"|0f|lovegreenstreet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625107; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup prerre.com IMMORTAL (Malware_Distribution)"; content:"|06|prerre|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620412; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 2288.org IMMORTAL (Malware_Distribution)"; content:"|04|2288|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2610610; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yourblenderparts.ru IMMORTAL (Malware_Infectors)"; content:"|10|yourblenderparts|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625244; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestnewsmall.ru IMMORTAL (Malware_Infectors)"; content:"|0c|bestnewsmall|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624822; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestnewhaven.ru IMMORTAL (Malware_Distribution)"; content:"|0c|bestnewhaven|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup homecarenation.ru IMMORTAL (Malware_Infectors)"; content:"|0e|homecarenation|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625018; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newgolfonline.ru IMMORTAL (Malware_Infectors)"; content:"|0d|newgolfonline|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625148; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newsourceworld.ru IMMORTAL (Malware_Infectors)"; content:"|0e|newsourceworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625235; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup redtagcentral.ru IMMORTAL (Malware_Infectors)"; content:"|0d|redtagcentral|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625237; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup samuest.ru IMMORTAL (Malware_Infectors)"; content:"|07|samuest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625238; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup supernewstuff.ru IMMORTAL (Malware_Infectors)"; content:"|0d|supernewstuff|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625240; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yourtagheuer.ru IMMORTAL (Malware_Infectors)"; content:"|0c|yourtagheuer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625245; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 2d7d.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|2d7d|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633699; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3dk1.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|3dk1|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633700; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 71pp.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|71pp|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633701; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 945e.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|945e|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633703; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f2hl.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|f2hl|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633734; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gtha.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|gtha|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633747; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f7p.ru IMMORTAL (Malware_Distribution)"; content:"|03|f7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619828; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup davtraff.com IMMORTAL (Malware_Infectors)"; content:"|08|davtraff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620434; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yenguide.com IMMORTAL (Malware_Distribution)"; content:"|08|yenguide|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627193; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup losotrana.com IMMORTAL (Malware_Infectors)"; content:"|09|losotrana|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625819; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pprom.ru IMMORTAL (Malware_Infectors)"; content:"|05|pprom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630030; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rogerk.us IMMORTAL (Malware_Infectors)"; content:"|06|rogerk|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630325; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup roundstorm.com IMMORTAL (Malware_Infectors)"; content:"|0a|roundstorm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621100; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup panasonic-tv.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0c|panasonic-tv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633791; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup insomniaboldinfoorg.com IMMORTAL (Malware_Distribution)"; content:"|13|insomniaboldinfoorg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627077; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup myyes104.com IMMORTAL (Malware_Distribution)"; content:"|08|myyes104|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627093; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dacenete.com IMMORTAL (Malware_Distribution)"; content:"|08|dacenete|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626758; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup chura.pl IMMORTAL (Malware_Distribution)"; content:"|05|chura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624785; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup amd-creations.com IMMORTAL (Malware_Distribution)"; content:"|0d|amd-creations|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626833; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aqarat-ksa.com IMMORTAL (Malware_Distribution)"; content:"|0a|aqarat-ksa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626834; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blogdetranssexuel.com IMMORTAL (Malware_Distribution)"; content:"|11|blogdetranssexuel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626841; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup doub1eclick.net IMMORTAL (Malware_Distribution)"; content:"|0b|doub1eclick|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626848; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eseducation.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|eseducation|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626855; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup golfmorocco.com IMMORTAL (Malware_Distribution)"; content:"|0b|golfmorocco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626865; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsmpayphone.com IMMORTAL (Malware_Distribution)"; content:"|0b|gsmpayphone|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626871; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup integratedidea.com IMMORTAL (Malware_Distribution)"; content:"|0e|integratedidea|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626890; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup khandagiridevelopers.com IMMORTAL (Malware_Distribution)"; content:"|14|khandagiridevelopers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626902; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup marchex.com IMMORTAL (Malware_Distribution)"; content:"|07|marchex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627087; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mmtrf.com IMMORTAL (Malware_Distribution)"; content:"|05|mmtrf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626941; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mtxa.net IMMORTAL (Malware_Distribution)"; content:"|04|mtxa|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626945; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mwonline.info IMMORTAL (Malware_Distribution)"; content:"|08|mwonline|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626946; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup myfucking-pussy.com IMMORTAL (Malware_Distribution)"; content:"|0f|myfucking-pussy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627091; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mykasker.com IMMORTAL (Malware_Distribution)"; content:"|08|mykasker|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626948; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup relax-july.ru IMMORTAL (Malware_Distribution)"; content:"|0a|relax-july|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626981; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rrezrel.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|rrezrel|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626984; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup simonrojas.com IMMORTAL (Malware_Distribution)"; content:"|0a|simonrojas|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626990; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sugarncream.ivyro.net IMMORTAL (Malware_Distribution)"; content:"|0b|sugarncream|05|ivyro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626996; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup supersplittester.com IMMORTAL (Malware_Distribution)"; content:"|10|supersplittester|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626997; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup taktiku.biz IMMORTAL (Malware_Distribution)"; content:"|07|taktiku|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626998; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup top-websharing.com IMMORTAL (Malware_Distribution)"; content:"|0e|top-websharing|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627004; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup toxicham.ru IMMORTAL (Malware_Distribution)"; content:"|08|toxicham|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627005; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup walesedu.com IMMORTAL (Malware_Distribution)"; content:"|08|walesedu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627015; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup findbigbearproperty.cn IMMORTAL (SEO_Fraud)"; content:"|13|findbigbearproperty|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619835; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup itra.cn IMMORTAL (Fake_AV)"; content:"|04|itra|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626893; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kuaiche.com IMMORTAL (Fake_AV)"; content:"|07|kuaiche|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626910; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kuailv.com IMMORTAL (Fake_AV)"; content:"|06|kuailv|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626911; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ledcac.com IMMORTAL (Fake_AV)"; content:"|06|ledcac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626917; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nimp.org IMMORTAL (Fake_AV)"; content:"|04|nimp|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2613438; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup payam.nu IMMORTAL (Fake_AV)"; content:"|05|payam|02|nu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626969; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup henshiwuliao.com IMMORTAL (Malware_Distribution)"; content:"|0c|henshiwuliao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627075; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup red-wolf.ru IMMORTAL (Malware_Distribution)"; content:"|08|red-wolf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619994; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup addonrock.ru IMMORTAL (Malware_Distribution)"; content:"|09|addonrock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624068; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup step2me.net IMMORTAL (Malware_Distribution)"; content:"|07|step2me|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620050; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 4e4en.com IMMORTAL (Spyware)"; content:"|05|4e4en|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619702; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup namethatshop.cn IMMORTAL (Spyware)"; content:"|0c|namethatshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619959; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ghura.pl IMMORTAL (Malware_Infectors)"; content:"|05|ghura|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620436; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gumblar.cn IMMORTAL (Malware_Distribution)"; content:"|07|gumblar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627026; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup afonya123.com IMMORTAL (Botnet_C&C)"; content:"|09|afonya123|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2623142; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sadkajt357.com IMMORTAL (Malware_Distribution)"; content:"|0a|sadkajt357|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620011; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup toolbarcom.org IMMORTAL (Malware_Distribution)"; content:"|0a|toolbarcom|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620086; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 318x.com IMMORTAL (Malware_Distribution)"; content:"|04|318x|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620441; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup acrossuniverseitbenet.com IMMORTAL (Spyware)"; content:"|15|acrossuniverseitbenet|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629912; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sol-stats.info IMMORTAL (Malware_Infectors)"; content:"|09|sol-stats|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633972; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hoefra.at IMMORTAL (Malware_Distribution)"; content:"|06|hoefra|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626877; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jaquemet-zehnder.ch IMMORTAL (Malware_Distribution)"; content:"|10|jaquemet-zehnder|02|ch"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628503; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pubetter.dk IMMORTAL (Malware_Distribution)"; content:"|08|pubetter|02|dk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619440; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup easychurch.ru IMMORTAL (Malware_Distribution)"; content:"|0a|easychurch|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620519; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup delhicakesngifts.com IMMORTAL (Malware_Distribution)"; content:"|10|delhicakesngifts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620500; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup emrahkeskin.com IMMORTAL (Malware_Distribution)"; content:"|0b|emrahkeskin|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620435; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup innkeyhr.net IMMORTAL (Malware_Distribution)"; content:"|08|innkeyhr|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620563; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup msnupdateserver.info IMMORTAL (Malware_Distribution)"; content:"|0f|msnupdateserver|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620438; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rollingwithrubicon.com IMMORTAL (Malware_Distribution)"; content:"|12|rollingwithrubicon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620650; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup water4health.com IMMORTAL (Malware_Distribution)"; content:"|0c|water4health|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620689; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xpointenemy.com IMMORTAL (Malware_Distribution)"; content:"|0b|xpointenemy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620697; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shopmoviefestival.cn IMMORTAL (Malware_Distribution)"; content:"|11|shopmoviefestival|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630489; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thekapita.com IMMORTAL (Malware_Distribution)"; content:"|09|thekapita|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630500; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup krclear.com IMMORTAL (Malware_Distribution)"; content:"|07|krclear|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626907; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup trenz.pl IMMORTAL (Malware_Distribution)"; content:"|05|trenz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622705; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup combinebet.cn IMMORTAL (Malware_Distribution)"; content:"|0a|combinebet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626844; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gianttopdiscover.cn IMMORTAL (Malware_Distribution)"; content:"|10|gianttopdiscover|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626859; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup litetopfindworld.cn IMMORTAL (Malware_Distribution)"; content:"|10|litetopfindworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626921; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newnetnameshop.cn IMMORTAL (Malware_Distribution)"; content:"|0e|newnetnameshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626951; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup parkinglotbet.cn IMMORTAL (Malware_Distribution)"; content:"|0d|parkinglotbet|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626967; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup premiumlocate.cn IMMORTAL (Malware_Distribution)"; content:"|0d|premiumlocate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626977; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5x.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626979; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thebestwaytofind.cn IMMORTAL (Malware_Distribution)"; content:"|10|thebestwaytofind|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627002; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bizaue.com IMMORTAL (Malware_Infectors)"; content:"|06|bizaue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626840; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ripubcc.com IMMORTAL (Malware_Infectors)"; content:"|07|ripubcc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626982; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 08zs.com IMMORTAL (Malware_Distribution)"; content:"|04|08zs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626823; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 1speed.info IMMORTAL (Spyware)"; content:"|06|1speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618311; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 2112111.com IMMORTAL (Malware_Distribution)"; content:"|07|2112111|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626825; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cutheatergroup.cn IMMORTAL (Malware_Distribution)"; content:"|0e|cutheatergroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627734; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dashbulag.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|dashbulag|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628977; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup findbigmoneygame.cn IMMORTAL (Malware_Distribution)"; content:"|10|findbigmoneygame|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626857; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup greatnamemovie.cn IMMORTAL (Malware_Distribution)"; content:"|0e|greatnamemovie|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626868; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nuttypiano.com IMMORTAL (Malware_Distribution)"; content:"|0a|nuttypiano|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625600; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oceandealer.cn IMMORTAL (Malware_Distribution)"; content:"|0b|oceandealer|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624588; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pamiangsao.com IMMORTAL (Malware_Distribution)"; content:"|0a|pamiangsao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629037; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pkgmitom.ru IMMORTAL (Malware_Distribution)"; content:"|08|pkgmitom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629038; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup robints.us IMMORTAL (Malware_Distribution)"; content:"|07|robints|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626983; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sites-counter.com IMMORTAL (Malware_Distribution)"; content:"|0d|sites-counter|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628644; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup support.orti.free.fr IMMORTAL (Malware_Distribution)"; content:"|07|support|04|orti|04|free|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628906; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup t-e-clive.com IMMORTAL (Malware_Distribution)"; content:"|09|t-e-clive|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620064; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup taogu.org.cn IMMORTAL (Malware_Distribution)"; content:"|05|taogu|03|org|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626999; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tyrolerfesten.se IMMORTAL (Malware_Distribution)"; content:"|0d|tyrolerfesten|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629504; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 7o8.net IMMORTAL (Malware_Distribution)"; content:"|03|7o8|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620442; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup abbcp.cn IMMORTAL (Malware_Distribution)"; content:"|05|abbcp|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645634; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bbsr.co.in IMMORTAL (Malware_Distribution)"; content:"|04|bbsr|02|co|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628666; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup letterssite.ru IMMORTAL (SEO_Fraud)"; content:"|0b|letterssite|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620399; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lifedrom.ru IMMORTAL (SEO_Fraud)"; content:"|08|lifedrom|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620400; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mamj.ru IMMORTAL (Malware_Distribution)"; content:"|04|mamj|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634054; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newlifeworld.ru IMMORTAL (SEO_Fraud)"; content:"|0c|newlifeworld|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620407; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zenitchampion.cn IMMORTAL (Malware_Distribution)"; content:"|0d|zenitchampion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645635; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kvarteretekorren.se IMMORTAL (Malware_Distribution)"; content:"|10|kvarteretekorren|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621543; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wwvv.us IMMORTAL (Malware_Distribution)"; content:"|04|wwvv|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627758; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup logisticservices.info IMMORTAL (Malware_Distribution)"; content:"|10|logisticservices|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628105; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup storeoffers.info IMMORTAL (Malware_Distribution)"; content:"|0b|storeoffers|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619456; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup stratix.info IMMORTAL (Malware_Distribution)"; content:"|07|stratix|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622243; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cathrynzfunz.com IMMORTAL (Phishing_and_Theft)"; content:"|0c|cathrynzfunz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620483; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gcounter.cn IMMORTAL (Malware_Distribution)"; content:"|08|gcounter|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622534; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup portaln.info IMMORTAL (Malware_Distribution)"; content:"|07|portaln|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621573; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup domain454002.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|0c|domain454002|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626846; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rentsatoday.com IMMORTAL (Botnet_C&C)"; content:"|0b|rentsatoday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624728; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup smert-test.ru IMMORTAL (Malware_Infectors)"; content:"|0a|smert-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620415; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sockslab.net IMMORTAL (Malware_Distribution)"; content:"|08|sockslab|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620038; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sphusa.com IMMORTAL (Botnet_C&C)"; content:"|06|sphusa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622195; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup splitssoft.com IMMORTAL (Malware_Infectors)"; content:"|0a|splitssoft|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626994; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup toppulse32.org IMMORTAL (Malware_Infectors)"; content:"|0a|toppulse32|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619461; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b5r.ru IMMORTAL (Malware_Distribution)"; content:"|03|b5r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626836; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b7p.ru IMMORTAL (Malware_Distribution)"; content:"|03|b7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626837; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b9g.at IMMORTAL (Malware_Distribution)"; content:"|03|b9g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626838; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tytowax.info IMMORTAL (Malware_Infectors)"; content:"|07|tytowax|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627008; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bastakigroup.com IMMORTAL (Botnet_C&C)"; content:"|0c|bastakigroup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620468; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qatar-business-guide.net IMMORTAL (Botnet_C&C)"; content:"|14|qatar-business-guide|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620634; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup google-stats50.info IMMORTAL (Malware_Distribution)"; content:"|0e|google-stats50|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624134; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aweleon.com IMMORTAL (Malware_Distribution)"; content:"|07|aweleon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620432; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pantali.com IMMORTAL (Malware_Distribution)"; content:"|07|pantali|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620617; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigsophieblog.com IMMORTAL (Malware_Infectors)"; content:"|0d|bigsophieblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630103; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dragongut.co.cc IMMORTAL (Malware_Infectors)"; content:"|09|dragongut|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630113; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup maniyakat.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|09|maniyakat|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619940; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 09cd.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|09cd|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631423; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup afrique-solidarite.org IMMORTAL (Malware_Distribution)"; content:"|12|afrique-solidarite|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631438; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alexander-ditz.de IMMORTAL (Malware_Distribution)"; content:"|0e|alexander-ditz|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628673; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup apadanagroups.ir IMMORTAL (Malware_Distribution)"; content:"|0d|apadanagroups|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627429; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup arekosicki.com IMMORTAL (Malware_Distribution)"; content:"|0a|arekosicki|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627761; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup artalepwellness.com IMMORTAL (Malware_Distribution)"; content:"|0f|artalepwellness|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628096; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup at1.it IMMORTAL (Malware_Distribution)"; content:"|03|at1|02|it"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631454; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup atelieray.com IMMORTAL (Malware_Distribution)"; content:"|09|atelieray|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627804; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bangkokfood.com IMMORTAL (Malware_Distribution)"; content:"|0b|bangkokfood|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627435; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bantontan.com IMMORTAL (Malware_Distribution)"; content:"|09|bantontan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627805; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup baseballcardcatalog.com IMMORTAL (Malware_Distribution)"; content:"|13|baseballcardcatalog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628522; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup baydem.com IMMORTAL (Malware_Distribution)"; content:"|06|baydem|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628523; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bellsdirectory.com IMMORTAL (Malware_Distribution)"; content:"|0e|bellsdirectory|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627914; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bellsworld.com IMMORTAL (Malware_Distribution)"; content:"|0a|bellsworld|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627450; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bizcardcolor.com IMMORTAL (Malware_Distribution)"; content:"|0c|bizcardcolor|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631462; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blackhollywoodhu.com IMMORTAL (Malware_Distribution)"; content:"|10|blackhollywoodhu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628524; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blschd.com IMMORTAL (Malware_Distribution)"; content:"|06|blschd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628097; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup blythe.la IMMORTAL (Malware_Distribution)"; content:"|06|blythe|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631463; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bobscopy.ca IMMORTAL (Malware_Distribution)"; content:"|08|bobscopy|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627581; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bookav.net IMMORTAL (Malware_Distribution)"; content:"|06|bookav|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628671; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bransonblast.com IMMORTAL (Malware_Distribution)"; content:"|0c|bransonblast|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631574; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brightspacedehradun.com IMMORTAL (Malware_Distribution)"; content:"|13|brightspacedehradun|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627810; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup casamango.freehostia.com IMMORTAL (Malware_Distribution)"; content:"|09|casamango|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631468; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cbx-north.se IMMORTAL (Malware_Distribution)"; content:"|09|cbx-north|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628110; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup chartinfo.net IMMORTAL (Malware_Distribution)"; content:"|09|chartinfo|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631470; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup clavosdecristo.es IMMORTAL (Malware_Distribution)"; content:"|0e|clavosdecristo|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631580; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cologne-mohair-dyers.com IMMORTAL (Malware_Distribution)"; content:"|14|cologne-mohair-dyers|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628531; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup compfuture.net IMMORTAL (Malware_Distribution)"; content:"|0a|compfuture|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628532; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup culturechine.org IMMORTAL (Malware_Distribution)"; content:"|0c|culturechine|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628494; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup day-sity.ho.ua IMMORTAL (Malware_Distribution)"; content:"|08|day-sity|02|ho|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627593; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dayspaxalapa.com IMMORTAL (Malware_Distribution)"; content:"|0c|dayspaxalapa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627542; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dbabasics.com IMMORTAL (Malware_Distribution)"; content:"|09|dbabasics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631590; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup demkarklima.com IMMORTAL (Malware_Distribution)"; content:"|0b|demkarklima|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628297; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup denisen.com.cn IMMORTAL (Malware_Distribution)"; content:"|07|denisen|03|com|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628390; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup designrj.com IMMORTAL (Malware_Distribution)"; content:"|08|designrj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628206; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup deutscheshaus.ge IMMORTAL (Malware_Distribution)"; content:"|0d|deutscheshaus|02|ge"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627266; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup diamonstar.cn IMMORTAL (Malware_Distribution)"; content:"|0a|diamonstar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631597; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup divineinnovation.net IMMORTAL (Malware_Distribution)"; content:"|10|divineinnovation|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628393; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup donjanhealth.com IMMORTAL (Malware_Distribution)"; content:"|0c|donjanhealth|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631482; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup drakken.com.ar IMMORTAL (Malware_Distribution)"; content:"|07|drakken|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631549; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ebi-live-chat.net IMMORTAL (Malware_Distribution)"; content:"|0d|ebi-live-chat|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628398; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup egrocoffeetr.com IMMORTAL (Malware_Distribution)"; content:"|0c|egrocoffeetr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631741; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup elaheh.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|06|elaheh|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628399; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup elizabethdschafer.com IMMORTAL (Malware_Distribution)"; content:"|11|elizabethdschafer|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628113; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup emuna.com.ua IMMORTAL (Malware_Distribution)"; content:"|05|emuna|03|com|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628401; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup englishrescue.com IMMORTAL (Malware_Distribution)"; content:"|0d|englishrescue|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632081; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup erapost.net IMMORTAL (Malware_Distribution)"; content:"|07|erapost|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619302; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ewela.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|ewela|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631486; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup expresshomecinema.com IMMORTAL (Malware_Distribution)"; content:"|11|expresshomecinema|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627993; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fashiontouch.net IMMORTAL (Malware_Distribution)"; content:"|0c|fashiontouch|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628496; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup felipeycamila.com.ar IMMORTAL (Malware_Distribution)"; content:"|0d|felipeycamila|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628497; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ferozkhan.in IMMORTAL (Malware_Distribution)"; content:"|09|ferozkhan|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628301; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ferrytopia.com IMMORTAL (Malware_Distribution)"; content:"|0a|ferrytopia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628099; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup focusonesthetics.com IMMORTAL (Malware_Distribution)"; content:"|10|focusonesthetics|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619080; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup folkartist-kr.com IMMORTAL (Malware_Distribution)"; content:"|0d|folkartist-kr|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628537; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freeviewbooks.tk IMMORTAL (Malware_Distribution)"; content:"|0d|freeviewbooks|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631751; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup funkyclients.nl IMMORTAL (Malware_Distribution)"; content:"|0c|funkyclients|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619081; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup g12.ro IMMORTAL (Malware_Distribution)"; content:"|03|g12|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628223; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gadgetsshore.com IMMORTAL (Malware_Distribution)"; content:"|0c|gadgetsshore|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627917; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup galleparadise.com IMMORTAL (Malware_Distribution)"; content:"|0d|galleparadise|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626109; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gang.dothome.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|gang|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628540; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup googlevirustemizleme.com IMMORTAL (Fake_AV)"; content:"|14|googlevirustemizleme|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628544; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gorselankara.com IMMORTAL (Malware_Distribution)"; content:"|0c|gorselankara|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628545; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup grameendev.org IMMORTAL (Malware_Distribution)"; content:"|0a|grameendev|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628116; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup graphicmanagementassociates.com IMMORTAL (Malware_Distribution)"; content:"|1b|graphicmanagementassociates|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628227; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gratisthumbs.com IMMORTAL (Malware_Distribution)"; content:"|0c|gratisthumbs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627433; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hickorys.ca IMMORTAL (Malware_Distribution)"; content:"|08|hickorys|02|ca"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628500; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hindustanrealtyservices.com IMMORTAL (Malware_Distribution)"; content:"|17|hindustanrealtyservices|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628229; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hopelife.in IMMORTAL (Malware_Distribution)"; content:"|08|hopelife|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628667; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hvsat6.freehostia.com IMMORTAL (Malware_Distribution)"; content:"|06|hvsat6|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631779; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup immo-bulgaria.de IMMORTAL (Malware_Distribution)"; content:"|0d|immo-bulgaria|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631785; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup incomltd.com IMMORTAL (Malware_Distribution)"; content:"|08|incomltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631787; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup industrialsurquillo.com IMMORTAL (Malware_Distribution)"; content:"|13|industrialsurquillo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628415; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup infograph.com.mx IMMORTAL (Malware_Distribution)"; content:"|09|infograph|03|com|02|mx"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627740; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ipac-bd.org IMMORTAL (Malware_Distribution)"; content:"|07|ipac-bd|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628303; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iris2009.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|iris2009|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628553; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup islacontoymexico.info IMMORTAL (Malware_Distribution)"; content:"|10|islacontoymexico|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627638; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup itillc.com IMMORTAL (Malware_Distribution)"; content:"|06|itillc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628554; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup japimen.net IMMORTAL (Malware_Distribution)"; content:"|07|japimen|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628668; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jetaimesuit.com IMMORTAL (Malware_Distribution)"; content:"|0b|jetaimesuit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628012; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup joeburns.eu IMMORTAL (Malware_Distribution)"; content:"|08|joeburns|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627846; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup johnbennett.com IMMORTAL (Malware_Distribution)"; content:"|0b|johnbennett|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628242; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup joy-leports.com IMMORTAL (Malware_Distribution)"; content:"|0b|joy-leports|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628304; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jubilantmattresses.com IMMORTAL (Malware_Distribution)"; content:"|12|jubilantmattresses|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628305; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kadalcok.net IMMORTAL (Malware_Distribution)"; content:"|08|kadalcok|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628504; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kadikoyanaokulu.info IMMORTAL (Malware_Distribution)"; content:"|0f|kadikoyanaokulu|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619086; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kandilkoy.com IMMORTAL (Malware_Distribution)"; content:"|09|kandilkoy|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627847; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kb40.com IMMORTAL (Malware_Distribution)"; content:"|04|kb40|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628557; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kcom-m.com IMMORTAL (Malware_Distribution)"; content:"|06|kcom-m|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628558; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kfcf.co.kr IMMORTAL (Malware_Distribution)"; content:"|04|kfcf|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628418; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup khezri-adine.ir IMMORTAL (Malware_Distribution)"; content:"|0c|khezri-adine|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628559; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kohyao.net IMMORTAL (Malware_Distribution)"; content:"|06|kohyao|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628560; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kortvideohem.se IMMORTAL (Malware_Distribution)"; content:"|0c|kortvideohem|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628506; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kyosoft.net IMMORTAL (Malware_Distribution)"; content:"|07|kyosoft|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631809; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup l-n-a.co.uk IMMORTAL (Malware_Distribution)"; content:"|05|l-n-a|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631810; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lagule.at IMMORTAL (Malware_Distribution)"; content:"|06|lagule|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628118; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lauwaert.net IMMORTAL (Malware_Distribution)"; content:"|08|lauwaert|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628564; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup leksakskungen.se IMMORTAL (Malware_Distribution)"; content:"|0d|leksakskungen|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628103; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lifeinsurancequestions.info IMMORTAL (Malware_Distribution)"; content:"|16|lifeinsurancequestions|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632206; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lordrizzo.com IMMORTAL (Malware_Distribution)"; content:"|09|lordrizzo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628565; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup maaandhra.com IMMORTAL (Malware_Distribution)"; content:"|09|maaandhra|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628567; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mallcom.co.kr IMMORTAL (Malware_Distribution)"; content:"|07|mallcom|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628507; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mashaei.ir IMMORTAL (Malware_Distribution)"; content:"|07|mashaei|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628581; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mesgurukula.com IMMORTAL (Malware_Distribution)"; content:"|0b|mesgurukula|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628248; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup metroeple.com IMMORTAL (Malware_Distribution)"; content:"|09|metroeple|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628426; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mobilisim.mobi IMMORTAL (Malware_Distribution)"; content:"|09|mobilisim|04|mobi"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628604; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mp3-muza.pl IMMORTAL (Malware_Distribution)"; content:"|08|mp3-muza|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631826; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup n-able.in IMMORTAL (Malware_Distribution)"; content:"|06|n-able|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632328; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nimaabedi.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|09|nimaabedi|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619368; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nimsaa.com IMMORTAL (Malware_Distribution)"; content:"|06|nimsaa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631831; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nongluck.com IMMORTAL (Malware_Distribution)"; content:"|08|nongluck|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619372; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ntoos.com IMMORTAL (Malware_Distribution)"; content:"|05|ntoos|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628672; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup o0w0o.com IMMORTAL (Malware_Distribution)"; content:"|05|o0w0o|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628635; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup okgrupo.com IMMORTAL (Malware_Distribution)"; content:"|07|okgrupo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619380; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oneindia.biz IMMORTAL (Malware_Distribution)"; content:"|08|oneindia|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631835; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup orbitalenhancements.com IMMORTAL (Malware_Distribution)"; content:"|13|orbitalenhancements|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619383; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup orhaninsaatltd.com IMMORTAL (Malware_Distribution)"; content:"|0e|orhaninsaatltd|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619385; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup panamaxexim.com IMMORTAL (Malware_Distribution)"; content:"|0b|panamaxexim|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619391; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pannatex.com IMMORTAL (Malware_Distribution)"; content:"|08|pannatex|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619392; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup petplant.hu IMMORTAL (Malware_Distribution)"; content:"|08|petplant|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619401; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup picafierce.com IMMORTAL (Malware_Distribution)"; content:"|0a|picafierce|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619404; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pin98.dothome.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|pin98|07|dothome|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619406; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ponysirindhorn.com IMMORTAL (Malware_Distribution)"; content:"|0e|ponysirindhorn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628637; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup poze.sloris.ro IMMORTAL (Malware_Distribution)"; content:"|04|poze|06|sloris|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619424; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup primobit.com IMMORTAL (Malware_Distribution)"; content:"|08|primobit|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632006; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup propertyadvancement.com IMMORTAL (Malware_Distribution)"; content:"|13|propertyadvancement|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619434; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup psgtech72.com IMMORTAL (Malware_Distribution)"; content:"|09|psgtech72|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619201; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup purunsj.com IMMORTAL (Malware_Distribution)"; content:"|07|purunsj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619443; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qvevri.ge IMMORTAL (Malware_Distribution)"; content:"|06|qvevri|02|ge"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619446; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup radiorocks.kiev.ua IMMORTAL (Malware_Distribution)"; content:"|0a|radiorocks|04|kiev|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632023; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rajzdravi.cz IMMORTAL (Malware_Distribution)"; content:"|09|rajzdravi|02|cz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628640; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sakarya-vho.org IMMORTAL (Malware_Distribution)"; content:"|0b|sakarya-vho|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632036; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup speedklicker.de IMMORTAL (Malware_Distribution)"; content:"|0c|speedklicker|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632051; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup swineflu-articles.com IMMORTAL (Malware_Distribution)"; content:"|11|swineflu-articles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620063; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tacsw.or.kr IMMORTAL (Malware_Distribution)"; content:"|05|tacsw|02|or|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620065; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tamiltouch.com IMMORTAL (Malware_Distribution)"; content:"|0a|tamiltouch|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620068; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup teh-g.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|05|teh-g|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620070; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tem97.org IMMORTAL (Malware_Distribution)"; content:"|05|tem97|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620073; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup theflyingpoodles.com IMMORTAL (Malware_Distribution)"; content:"|10|theflyingpoodles|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620078; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thuonghuyenbooks.vn IMMORTAL (Malware_Distribution)"; content:"|10|thuonghuyenbooks|02|vn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629524; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tomo7e.com IMMORTAL (Malware_Distribution)"; content:"|06|tomo7e|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620085; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tvindc.com IMMORTAL (Malware_Distribution)"; content:"|06|tvindc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620093; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup typicaldesign.net IMMORTAL (Malware_Distribution)"; content:"|0d|typicaldesign|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629526; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ugurkargonakliyat.com IMMORTAL (Malware_Distribution)"; content:"|11|ugurkargonakliyat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620099; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup valleyseve.de IMMORTAL (Malware_Distribution)"; content:"|0a|valleyseve|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622903; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vankami.net IMMORTAL (Malware_Distribution)"; content:"|07|vankami|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620109; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup versaillesstudio.com IMMORTAL (Malware_Distribution)"; content:"|10|versaillesstudio|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620113; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup viamediasolutions.com IMMORTAL (Malware_Distribution)"; content:"|11|viamediasolutions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620114; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vidaabundanteheredia.pablohost.com IMMORTAL (Malware_Distribution)"; content:"|14|vidaabundanteheredia|09|pablohost|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620115; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vikinginfotech.com IMMORTAL (Malware_Distribution)"; content:"|0e|vikinginfotech|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620118; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup villadepinto.com IMMORTAL (Malware_Distribution)"; content:"|0c|villadepinto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620119; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup waa.pl IMMORTAL (Malware_Distribution)"; content:"|03|waa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629523; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup walnut.la IMMORTAL (Malware_Distribution)"; content:"|06|walnut|02|la"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620126; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wapika.sitefr.info IMMORTAL (Malware_Distribution)"; content:"|06|wapika|06|sitefr|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620128; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup webdogs.nl IMMORTAL (Malware_Distribution)"; content:"|07|webdogs|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620134; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wepro-fashions.com IMMORTAL (Malware_Distribution)"; content:"|0e|wepro-fashions|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620140; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wolfsclassiccarrent.nl IMMORTAL (Malware_Distribution)"; content:"|13|wolfsclassiccarrent|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620144; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wolfshop.pl IMMORTAL (Malware_Distribution)"; content:"|08|wolfshop|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620145; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zealups.com IMMORTAL (Malware_Distribution)"; content:"|07|zealups|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620175; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1k.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619550; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1m.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619551; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1n.in IMMORTAL (Malware_Distribution)"; content:"|03|q1n|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619552; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1u.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619553; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q40.ru IMMORTAL (Malware_Distribution)"; content:"|03|q40|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619561; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5a.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619563; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5c.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619564; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5l.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619566; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5u.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619569; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5v.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619570; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5y.in IMMORTAL (Malware_Distribution)"; content:"|03|q5y|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619571; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0r.in IMMORTAL (Malware_Distribution)"; content:"|03|u0r|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619578; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0s.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619580; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0t.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619581; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u19.in IMMORTAL (Malware_Distribution)"; content:"|03|u19|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619582; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1j.in IMMORTAL (Malware_Distribution)"; content:"|03|u1j|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619584; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1l.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619585; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5d.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619593; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5l.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619596; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5w.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619598; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u6c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619600; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7g.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619605; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7o.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619606; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7z.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619607; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u9a.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619615; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u9i.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619617; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x0a.in IMMORTAL (Malware_Distribution)"; content:"|03|x0a|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619619; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x1g.in IMMORTAL (Malware_Distribution)"; content:"|03|x1g|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619624; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x3v.in IMMORTAL (Malware_Distribution)"; content:"|03|x3v|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619629; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x5o.ru IMMORTAL (Malware_Distribution)"; content:"|03|x5o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619632; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x6i.ru IMMORTAL (Malware_Distribution)"; content:"|03|x6i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619633; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x6p.in IMMORTAL (Malware_Distribution)"; content:"|03|x6p|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619634; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x7b.in IMMORTAL (Malware_Distribution)"; content:"|03|x7b|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619636; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8e.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619644; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xb4.in IMMORTAL (Malware_Distribution)"; content:"|03|xb4|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619665; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xc6.in IMMORTAL (Malware_Distribution)"; content:"|03|xc6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619668; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xf8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xf8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619675; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ai-studio.jp IMMORTAL (Malware_Distribution)"; content:"|09|ai-studio|02|jp"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620431; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup americanmedicalproducts.us IMMORTAL (Malware_Distribution)"; content:"|17|americanmedicalproducts|02|us"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620456; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tacticz.be IMMORTAL (Malware_Distribution)"; content:"|07|tacticz|02|be"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620066; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup org-tech.net IMMORTAL (Malware_Distribution)"; content:"|08|org-tech|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620411; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup youramps.ru IMMORTAL (Malware_Distribution)"; content:"|08|youramps|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620429; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup add-block-filter.info IMMORTAL (Malware_Distribution)"; content:"|10|add-block-filter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629913; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup full-x-clips.in IMMORTAL (Malware_Distribution)"; content:"|0c|full-x-clips|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627469; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0e.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620095; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u19.ru IMMORTAL (Malware_Distribution)"; content:"|03|u19|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620096; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u9j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620097; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x0v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620149; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x1i.ru IMMORTAL (Malware_Distribution)"; content:"|03|x1i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620151; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x3b.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620152; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8y.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620158; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620159; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9w.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620160; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xb4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xb4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620161; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xc6.ru IMMORTAL (Malware_Distribution)"; content:"|03|xc6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620162; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xc7.ru IMMORTAL (Malware_Distribution)"; content:"|03|xc7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620163; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xe6.ru IMMORTAL (Malware_Distribution)"; content:"|03|xe6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620164; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xj4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xj4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620167; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xk9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xk9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620168; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup flo4.biz IMMORTAL (Malware_Distribution)"; content:"|04|flo4|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619094; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup t-online.hu IMMORTAL (Malware_Distribution)"; content:"|08|t-online|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620181; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adingurj.com IMMORTAL (Malware_Infectors)"; content:"|08|adingurj|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619243; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c8t.ru IMMORTAL (Malware_Distribution)"; content:"|03|c8t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619525; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f5l.at IMMORTAL (Malware_Distribution)"; content:"|03|f5l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619528; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f5l.ru IMMORTAL (Malware_Distribution)"; content:"|03|f5l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619529; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f5x.ru IMMORTAL (Malware_Distribution)"; content:"|03|f5x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619530; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f6p.at IMMORTAL (Malware_Distribution)"; content:"|03|f6p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619531; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q3b.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619557; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5n.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619568; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619577; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1m.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619586; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1x.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619588; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1y.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619589; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u3h.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619591; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5e.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619594; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5k.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619595; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u6v.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619602; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7f.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619604; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8i.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619609; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619610; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8r.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619611; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8t.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619612; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8v.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619613; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u9c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619616; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x0c.ru IMMORTAL (Malware_Distribution)"; content:"|03|x0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619622; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x3a.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619628; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x3v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619630; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x3y.ru IMMORTAL (Malware_Distribution)"; content:"|03|x3y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619631; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x6r.ru IMMORTAL (Malware_Distribution)"; content:"|03|x6r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619635; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9e.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619656; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9f.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619657; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9g.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619658; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9m.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619659; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9n.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619660; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9u.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619663; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xg8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xg8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619679; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yiiw.in IMMORTAL (Malware_Distribution)"; content:"|04|yiiw|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619695; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u6d.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619601; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bombino777.com IMMORTAL (Malware_Distribution)"; content:"|0a|bombino777|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629933; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wvg7.cn IMMORTAL (Malware_Infectors)"; content:"|04|wvg7|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627785; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ads-block-13.info IMMORTAL (Malware_Infectors)"; content:"|0c|ads-block-13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620215; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup counter13.info IMMORTAL (Malware_Infectors)"; content:"|09|counter13|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620244; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup icqtel.ru IMMORTAL (Malware_Infectors)"; content:"|06|icqtel|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620281; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nokiaicq.ru IMMORTAL (Malware_Infectors)"; content:"|08|nokiaicq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620322; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qiiiq.ru IMMORTAL (Malware_Infectors)"; content:"|05|qiiiq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620331; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup t-age.ru IMMORTAL (Malware_Infectors)"; content:"|05|t-age|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620346; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 18xn.com IMMORTAL (Malware_Distribution)"; content:"|04|18xn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619491; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 30th-birthday.com IMMORTAL (Malware_Distribution)"; content:"|0d|30th-birthday|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627760; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 39j.ru IMMORTAL (Malware_Distribution)"; content:"|03|39j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619208; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3c9.ru IMMORTAL (Malware_Distribution)"; content:"|03|3c9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620430; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3cl.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cl|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619217; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a-n-d-the.com IMMORTAL (Malware_Distribution)"; content:"|09|a-n-d-the|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2618221; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a3q.ru IMMORTAL (Malware_Distribution)"; content:"|03|a3q|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627725; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a3t.ru IMMORTAL (Malware_Distribution)"; content:"|03|a3t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627726; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup activeprotect.cn IMMORTAL (Malware_Distribution)"; content:"|0d|activeprotect|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619696; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ancom1.ru IMMORTAL (Malware_Distribution)"; content:"|06|ancom1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627205; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup automobileandtransport.com IMMORTAL (Malware_Distribution)"; content:"|16|automobileandtransport|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631455; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b1a.ru IMMORTAL (Malware_Distribution)"; content:"|03|b1a|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627763; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b5c.ru IMMORTAL (Malware_Distribution)"; content:"|03|b5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627764; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b5z.ru IMMORTAL (Malware_Distribution)"; content:"|03|b5z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627765; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b6l.ru IMMORTAL (Malware_Distribution)"; content:"|03|b6l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627766; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b6t.ru IMMORTAL (Malware_Distribution)"; content:"|03|b6t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627730; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b8e.ru IMMORTAL (Malware_Distribution)"; content:"|03|b8e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627768; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestfilmlife.cn IMMORTAL (Malware_Distribution)"; content:"|0c|bestfilmlife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619512; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bestlitevideo.cn IMMORTAL (Malware_Distribution)"; content:"|0d|bestlitevideo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627431; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtopstats.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigtopstats|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627731; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup billingcxn.com IMMORTAL (Malware_Distribution)"; content:"|0a|billingcxn|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619777; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brandnameshoppin.cn IMMORTAL (Malware_Distribution)"; content:"|10|brandnameshoppin|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619513; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brenz.pl IMMORTAL (Malware_Distribution)"; content:"|05|brenz|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619785; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c1z.ru IMMORTAL (Malware_Distribution)"; content:"|03|c1z|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627732; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ce5.ru IMMORTAL (Malware_Distribution)"; content:"|03|ce5|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619527; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ckt4.cn IMMORTAL (Malware_Infectors)"; content:"|04|ckt4|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627432; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup coolnamemart.cn IMMORTAL (Malware_Distribution)"; content:"|0c|coolnamemart|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627733; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cutalot.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|07|cutalot|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627459; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup deryam.biz IMMORTAL (Malware_Distribution)"; content:"|06|deryam|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619807; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dreamheartsnow.cn IMMORTAL (Malware_Distribution)"; content:"|0e|dreamheartsnow|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627772; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eachbul.com IMMORTAL (Malware_Distribution)"; content:"|07|eachbul|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627735; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup echarts.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|07|echarts|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627982; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup electronicssense-search.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|17|electronicssense-search|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628300; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freshsummer.ru IMMORTAL (Malware_Distribution)"; content:"|0b|freshsummer|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627617; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gclubdiary.com IMMORTAL (Malware_Distribution)"; content:"|0a|gclubdiary|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631489; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gzpf.in IMMORTAL (Malware_Distribution)"; content:"|04|gzpf|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627738; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hugebestbuy.cn IMMORTAL (Malware_Distribution)"; content:"|0b|hugebestbuy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619535; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iark.net IMMORTAL (Malware_Distribution)"; content:"|04|iark|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620280; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jkk.tw IMMORTAL (Malware_Distribution)"; content:"|03|jkk|02|tw"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627640; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jumbobestrate.cn IMMORTAL (Malware_Distribution)"; content:"|0d|jumbobestrate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627741; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup khetiharagro.com IMMORTAL (Malware_Distribution)"; content:"|0c|khetiharagro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624892; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup koreaexport.co.kr IMMORTAL (Malware_Distribution)"; content:"|0b|koreaexport|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627849; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lzwn.in IMMORTAL (Malware_Distribution)"; content:"|04|lzwn|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619537; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup microsotf.cn IMMORTAL (Malware_Infectors)"; content:"|09|microsotf|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620307; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mixgrouptravel.cn IMMORTAL (Malware_Distribution)"; content:"|0e|mixgrouptravel|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627779; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nettry.tk IMMORTAL (Malware_Distribution)"; content:"|06|nettry|02|tk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625829; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup online358.net IMMORTAL (Malware_Distribution)"; content:"|09|online358|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619539; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup partychimp.com IMMORTAL (Malware_Distribution)"; content:"|0a|partychimp|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624930; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup prodin.com.ar IMMORTAL (Malware_Distribution)"; content:"|06|prodin|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627780; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0c.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619541; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0i.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619542; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0k.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619543; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0l.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619544; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0u.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619545; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0x.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619546; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1b.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619547; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1d.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1d|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619548; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1w.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627666; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q3s.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3s|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627667; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup rajresidencydelhi.com IMMORTAL (Malware_Distribution)"; content:"|11|rajresidencydelhi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629046; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup seamscreative.info IMMORTAL (Malware_Distribution)"; content:"|0d|seamscreative|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627129; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup secretsalesaffiliate.net IMMORTAL (Malware_Distribution)"; content:"|14|secretsalesaffiliate|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628764; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shopfilmworld.cn IMMORTAL (Malware_Distribution)"; content:"|0d|shopfilmworld|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619574; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shoponlinefilmsite.cn IMMORTAL (Malware_Distribution)"; content:"|12|shoponlinefilmsite|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619575; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shoppicturelife.cn IMMORTAL (Malware_Distribution)"; content:"|0f|shoppicturelife|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619576; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup soul-suply.ru IMMORTAL (Malware_Distribution)"; content:"|0a|soul-suply|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628646; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup spywareshop.info IMMORTAL (Malware_Infectors)"; content:"|0b|spywareshop|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620045; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup supermixlotonline.cn IMMORTAL (Malware_Distribution)"; content:"|11|supermixlotonline|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627922; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thaistarlight.com IMMORTAL (Malware_Distribution)"; content:"|0d|thaistarlight|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620872; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup turbonamestore.cn IMMORTAL (Malware_Distribution)"; content:"|0e|turbonamestore|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627750; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627751; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627752; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5c.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627753; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7p.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627699; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup updatedate.cn IMMORTAL (Malware_Infectors)"; content:"|0a|updatedate|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627754; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wardher.com IMMORTAL (Malware_Distribution)"; content:"|07|wardher|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2630893; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wemsg.com IMMORTAL (Malware_Distribution)"; content:"|05|wemsg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620139; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xb6.ru IMMORTAL (Malware_Distribution)"; content:"|03|xb6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627717; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xc8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xc8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627718; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yb-sport-555.cn IMMORTAL (Malware_Distribution)"; content:"|0c|yb-sport-555|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627720; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup illusionfest.ru IMMORTAL (Malware_Distribution)"; content:"|0c|illusionfest|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628101; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yourlotcar.cn IMMORTAL (Malware_Distribution)"; content:"|0a|yourlotcar|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627721; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u6l.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627698; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ltkq.in IMMORTAL (Malware_Distribution)"; content:"|04|ltkq|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628106; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup superkahn.ru IMMORTAL (SEO_Fraud)"; content:"|09|superkahn|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620417; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 39t.ru IMMORTAL (Malware_Distribution)"; content:"|03|39t|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628295; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 39v.ru IMMORTAL (Malware_Distribution)"; content:"|03|39v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628311; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3bq.ru IMMORTAL (Malware_Distribution)"; content:"|03|3bq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619212; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3ca.ru IMMORTAL (Malware_Distribution)"; content:"|03|3ca|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619214; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3cf.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cf|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619215; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3cq.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cq|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619218; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3cw.ru IMMORTAL (Malware_Distribution)"; content:"|03|3cw|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619219; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3f6.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619226; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3f7.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619227; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3f8.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619228; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3f9.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619229; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 6w2.ru IMMORTAL (Malware_Distribution)"; content:"|03|6w2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619233; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a3j.ru IMMORTAL (Malware_Distribution)"; content:"|03|a3j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619234; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5f.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5f|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619235; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5h.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619238; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5i.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5i|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619239; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5j.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619240; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aireuregio.de IMMORTAL (Malware_Distribution)"; content:"|0a|aireuregio|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631440; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aj4.ru IMMORTAL (Malware_Distribution)"; content:"|03|aj4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619246; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup al3shaq.com IMMORTAL (Malware_Distribution)"; content:"|07|al3shaq|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631441; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup amour-sexo.com IMMORTAL (Malware_Distribution)"; content:"|0a|amour-sexo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631446; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup anamaithaperng.com IMMORTAL (Malware_Distribution)"; content:"|0e|anamaithaperng|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631447; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup anandayogaa.org IMMORTAL (Malware_Distribution)"; content:"|0b|anandayogaa|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631448; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aqua-tectum.hu IMMORTAL (Malware_Distribution)"; content:"|0b|aqua-tectum|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631449; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup asteam.fr IMMORTAL (Malware_Distribution)"; content:"|06|asteam|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631453; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ce5.at IMMORTAL (Malware_Distribution)"; content:"|03|ce5|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619273; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eguyendu.com IMMORTAL (Malware_Distribution)"; content:"|08|eguyendu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626761; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup introgagu.com IMMORTAL (Malware_Distribution)"; content:"|09|introgagu|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631497; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iranjoc.com IMMORTAL (Malware_Distribution)"; content:"|07|iranjoc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631498; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jzion.cn IMMORTAL (Malware_Distribution)"; content:"|05|jzion|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631803; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lifezilla.ru IMMORTAL (SEO_Fraud)"; content:"|09|lifezilla|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620402; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lifoo.ru IMMORTAL (SEO_Fraud)"; content:"|05|lifoo|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620403; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nt010.cn IMMORTAL (Malware_Distribution)"; content:"|05|nt010|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629338; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oisrup.com IMMORTAL (Malware_Distribution)"; content:"|06|oisrup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631213; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup parkperson.ru IMMORTAL (SEO_Fraud)"; content:"|0a|parkperson|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619394; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qualitysuper.ru IMMORTAL (SEO_Fraud)"; content:"|0c|qualitysuper|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620414; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup terminal-service.net IMMORTAL (Malware_Distribution)"; content:"|10|terminal-service|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620074; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup testoid.ru IMMORTAL (SEO_Fraud)"; content:"|07|testoid|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620421; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup the-previous-life.ru IMMORTAL (SEO_Fraud)"; content:"|11|the-previous-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620422; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8l.in IMMORTAL (Malware_Distribution)"; content:"|03|x8l|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619645; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8l.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619646; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8m.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619647; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8n.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619648; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8o.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619649; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8v.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619652; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9o.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619661; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x9p.ru IMMORTAL (Malware_Distribution)"; content:"|03|x9p|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619662; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xi3.ru IMMORTAL (Malware_Distribution)"; content:"|03|xi3|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619684; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xt6.in IMMORTAL (Malware_Distribution)"; content:"|03|xt6|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619691; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jsguangji.cn IMMORTAL (Malware_Distribution)"; content:"|09|jsguangji|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619200; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup siyou.org.cn IMMORTAL (Malware_Distribution)"; content:"|05|siyou|03|org|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619202; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup waztuok.cn IMMORTAL (Malware_Distribution)"; content:"|07|waztuok|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619474; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bale.ws IMMORTAL (Malware_Distribution)"; content:"|04|bale|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620232; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup detkasupe.co.cc IMMORTAL (Malware_Distribution)"; content:"|09|detkasupe|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631955; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup fuqidi9.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|fuqidi9|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631330; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mp3car.ru IMMORTAL (Malware_Distribution)"; content:"|06|mp3car|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632325; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup crotopmodels.com IMMORTAL (Malware_Distribution)"; content:"|0c|crotopmodels|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631307; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup booblegum19.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|booblegum19|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631464; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shgeru43hj.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|shgeru43hj|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2632715; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup truepants.ru IMMORTAL (Malware_Distribution)"; content:"|09|truepants|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2625442; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wmvcentral.net IMMORTAL (Malware_Distribution)"; content:"|0a|wmvcentral|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2621638; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup motionvm.com IMMORTAL (Malware_Distribution)"; content:"|08|motionvm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620704; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adbnr.ru IMMORTAL (Malware_Distribution)"; content:"|05|adbnr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620201; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup htmlads.ru IMMORTAL (Malware_Infectors)"; content:"|07|htmlads|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620279; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3bh.ru IMMORTAL (Malware_Distribution)"; content:"|03|3bh|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619210; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup daxia123.cn IMMORTAL (Malware_Distribution)"; content:"|08|daxia123|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628296; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eplarine.com IMMORTAL (Malware_Distribution)"; content:"|08|eplarine|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2626762; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imagehacks.info IMMORTAL (Malware_Distribution)"; content:"|0a|imagehacks|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627773; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3e0.ru IMMORTAL (Malware_Distribution)"; content:"|03|3e0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619199; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3ew.ru IMMORTAL (Malware_Distribution)"; content:"|03|3ew|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619222; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3f2.ru IMMORTAL (Malware_Distribution)"; content:"|03|3f2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619224; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ncccnnnc.cn IMMORTAL (Malware_Distribution)"; content:"|08|ncccnnnc|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620318; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup age-free.ru IMMORTAL (Malware_Distribution)"; content:"|08|age-free|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619724; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aqobeyv.cn IMMORTAL (Malware_Distribution)"; content:"|07|aqobeyv|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619743; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup biozavr.ru IMMORTAL (Malware_Distribution)"; content:"|07|biozavr|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619778; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup biozov.ru IMMORTAL (Malware_Distribution)"; content:"|06|biozov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619779; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cybipmo.cn IMMORTAL (Malware_Distribution)"; content:"|07|cybipmo|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619804; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gevyta.cn IMMORTAL (Malware_Distribution)"; content:"|06|gevyta|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619851; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oqaezfy.cn IMMORTAL (Malware_Distribution)"; content:"|07|oqaezfy|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619971; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup osujyre.cn IMMORTAL (Malware_Distribution)"; content:"|07|osujyre|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619972; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup susnoj.cn IMMORTAL (Malware_Distribution)"; content:"|06|susnoj|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620056; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sweetfay.cn IMMORTAL (Malware_Distribution)"; content:"|08|sweetfay|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620059; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup upiumry.cn IMMORTAL (Malware_Distribution)"; content:"|07|upiumry|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620102; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup uzehayb.cn IMMORTAL (Malware_Distribution)"; content:"|07|uzehayb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620106; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ynyxeg.cn IMMORTAL (Malware_Distribution)"; content:"|06|ynyxeg|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620170; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 33duraka.info IMMORTAL (Malware_Infectors)"; content:"|08|33duraka|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619701; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5m.ru IMMORTAL (Malware_Distribution)"; content:"|03|a5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627727; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adtcp.ru IMMORTAL (Malware_Distribution)"; content:"|05|adtcp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620205; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alienradar.ru IMMORTAL (Malware_Distribution)"; content:"|0a|alienradar|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2624073; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup amusecity.com IMMORTAL (Malware_Distribution)"; content:"|09|amusecity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627564; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup angelsinuniform.com IMMORTAL (Malware_Distribution)"; content:"|0f|angelsinuniform|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620220; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bannerdriven.ru IMMORTAL (Malware_Distribution)"; content:"|0c|bannerdriven|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620206; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bannert.ru IMMORTAL (Malware_Distribution)"; content:"|07|bannert|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620207; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bizbrobiz.cn IMMORTAL (Malware_Infectors)"; content:"|09|bizbrobiz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620392; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup black-engine.cn IMMORTAL (Malware_Infectors)"; content:"|0c|black-engine|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620209; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup counterweb.cn IMMORTAL (Malware_Infectors)"; content:"|0a|counterweb|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620394; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gobcounter.org IMMORTAL (Malware_Distribution)"; content:"|0a|gobcounter|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619855; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup googlle.in IMMORTAL (Malware_Distribution)"; content:"|07|googlle|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619857; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup imgnode.cn IMMORTAL (Malware_Infectors)"; content:"|07|imgnode|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619899; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup live-counter.info IMMORTAL (Malware_Infectors)"; content:"|0c|live-counter|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620404; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mefa.ws IMMORTAL (Malware_Infectors)"; content:"|04|mefa|02|ws"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620305; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mobydickrock.ru IMMORTAL (Malware_Distribution)"; content:"|0c|mobydickrock|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620311; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nailxpert.com IMMORTAL (Phishing_and_Theft)"; content:"|09|nailxpert|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620406; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup newsoff.net IMMORTAL (Malware_Infectors)"; content:"|07|newsoff|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620408; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pietka.eu IMMORTAL (Malware_Distribution)"; content:"|06|pietka|02|eu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627743; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup proanalytics.cn IMMORTAL (Malware_Infectors)"; content:"|0c|proanalytics|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620413; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ravelotti.cn IMMORTAL (Malware_Infectors)"; content:"|09|ravelotti|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619991; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup style-boards.com IMMORTAL (Malware_Infectors)"; content:"|0c|style-boards|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620416; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sutadut.co.cc IMMORTAL (Malware_Infectors)"; content:"|07|sutadut|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2622881; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup testodrome.ru IMMORTAL (Malware_Infectors)"; content:"|0a|testodrome|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620420; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup thestatsgov.info IMMORTAL (Spyware)"; content:"|0b|thestatsgov|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620423; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vseseriozno.cn IMMORTAL (Malware_Infectors)"; content:"|0b|vseseriozno|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620426; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup worldrat.ru IMMORTAL (Malware_Infectors)"; content:"|08|worldrat|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620427; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yondental.co.kr IMMORTAL (Malware_Distribution)"; content:"|09|yondental|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620383; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nt002.cn IMMORTAL (Malware_Distribution)"; content:"|05|nt002|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620178; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yournamequickshop.cn IMMORTAL (Spyware)"; content:"|11|yournamequickshop|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620200; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 9speed.info IMMORTAL (Malware_Distribution)"; content:"|06|9speed|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628518; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 9spice.info IMMORTAL (Malware_Distribution)"; content:"|06|9spice|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628519; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup add-block-11.info IMMORTAL (Malware_Infectors)"; content:"|0c|add-block-11|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619717; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup anzantra.se IMMORTAL (Malware_Distribution)"; content:"|08|anzantra|02|se"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620226; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b8o.ru IMMORTAL (Malware_Distribution)"; content:"|03|b8o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627944; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b9g.ru IMMORTAL (Malware_Distribution)"; content:"|03|b9g|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627945; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup beofree.ru IMMORTAL (Malware_Distribution)"; content:"|07|beofree|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620233; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brandschutztechnik-hartmann.de IMMORTAL (Malware_Distribution)"; content:"|1b|brandschutztechnik-hartmann|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627955; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup deth-test.ru IMMORTAL (Malware_Infectors)"; content:"|09|deth-test|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620246; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup feelife.ru IMMORTAL (Malware_Distribution)"; content:"|07|feelife|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620255; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hostads.cn IMMORTAL (Malware_Distribution)"; content:"|07|hostads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628501; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup m77s.cn IMMORTAL (Malware_Infectors)"; content:"|04|m77s|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619938; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nbakoff.com IMMORTAL (Malware_Infectors)"; content:"|07|nbakoff|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619961; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup neimeetsmysla.cn IMMORTAL (Malware_Distribution)"; content:"|0d|neimeetsmysla|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619538; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup past-another-life.ru IMMORTAL (Malware_Infectors)"; content:"|11|past-another-life|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619975; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup supernil.ru IMMORTAL (Malware_Infectors)"; content:"|08|supernil|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620418; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yessvaz.cn IMMORTAL (Malware_Distribution)"; content:"|07|yessvaz|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619484; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5j.at IMMORTAL (Malware_Distribution)"; content:"|03|a5j|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619710; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a5m.at IMMORTAL (Malware_Distribution)"; content:"|03|a5m|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619711; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b5r.at IMMORTAL (Malware_Distribution)"; content:"|03|b5r|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619753; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b6l.at IMMORTAL (Malware_Distribution)"; content:"|03|b6l|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619754; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b6t.at IMMORTAL (Malware_Distribution)"; content:"|03|b6t|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619755; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b7g.at IMMORTAL (Malware_Distribution)"; content:"|03|b7g|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619756; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup b7p.at IMMORTAL (Malware_Distribution)"; content:"|03|b7p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619757; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup beachhousename.cn IMMORTAL (Malware_Distribution)"; content:"|0e|beachhousename|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619766; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtopleads.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigtopleads|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619775; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bigtoprocks.cn IMMORTAL (Malware_Distribution)"; content:"|0b|bigtoprocks|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619776; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bqtl.in IMMORTAL (Malware_Distribution)"; content:"|04|bqtl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619782; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c6h.at IMMORTAL (Malware_Distribution)"; content:"|03|c6h|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619790; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c8t.at IMMORTAL (Malware_Distribution)"; content:"|03|c8t|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619791; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c9u.at IMMORTAL (Malware_Distribution)"; content:"|03|c9u|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619792; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dynamicfilmmedia.cn IMMORTAL (Malware_Distribution)"; content:"|10|dynamicfilmmedia|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619814; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f7p.at IMMORTAL (Malware_Distribution)"; content:"|03|f7p|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619827; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f7y.at IMMORTAL (Malware_Distribution)"; content:"|03|f7y|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619829; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kkxv.in IMMORTAL (Malware_Distribution)"; content:"|04|kkxv|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619921; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup martpictureexistence.cn IMMORTAL (Malware_Distribution)"; content:"|14|martpictureexistence|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619941; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup meldorgroup.cn IMMORTAL (Malware_Distribution)"; content:"|0b|meldorgroup|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619946; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nqrl.in IMMORTAL (Malware_Distribution)"; content:"|04|nqrl|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619967; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oufc.in IMMORTAL (Malware_Distribution)"; content:"|04|oufc|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619973; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q0w.ru IMMORTAL (Malware_Distribution)"; content:"|03|q0w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619984; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1l.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1l|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619986; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q3c.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3c|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619987; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q5k.ru IMMORTAL (Malware_Distribution)"; content:"|03|q5k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619988; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u0r.ru IMMORTAL (Malware_Distribution)"; content:"|03|u0r|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620182; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u1j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u1j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620183; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u3j.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3j|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620184; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u3m.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620185; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u3y.ru IMMORTAL (Malware_Distribution)"; content:"|03|u3y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620187; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5m.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5m|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620188; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u5v.ru IMMORTAL (Malware_Distribution)"; content:"|03|u5v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620189; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u6n.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620191; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7e.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7e|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620192; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7n.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620193; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u7x.ru IMMORTAL (Malware_Distribution)"; content:"|03|u7x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620194; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620195; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u8h.ru IMMORTAL (Malware_Distribution)"; content:"|03|u8h|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620196; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u9b.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620197; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u9k.ru IMMORTAL (Malware_Distribution)"; content:"|03|u9k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620198; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3b4.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619497; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c8b.ru IMMORTAL (Malware_Distribution)"; content:"|03|c8b|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619523; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 39u.ru IMMORTAL (Malware_Distribution)"; content:"|03|39u|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619492; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 39w.ru IMMORTAL (Malware_Distribution)"; content:"|03|39w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619493; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3a1.ru IMMORTAL (Malware_Distribution)"; content:"|03|3a1|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619495; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3a2.ru IMMORTAL (Malware_Distribution)"; content:"|03|3a2|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619496; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3b6.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b6|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619499; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3b7.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b7|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619500; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3b8.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619501; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3b9.ru IMMORTAL (Malware_Distribution)"; content:"|03|3b9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619502; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 3bp.ru IMMORTAL (Malware_Distribution)"; content:"|03|3bp|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619503; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup c8k.ru IMMORTAL (Malware_Distribution)"; content:"|03|c8k|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619524; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q1v.ru IMMORTAL (Malware_Distribution)"; content:"|03|q1v|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619554; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q3n.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3n|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619559; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup q3o.ru IMMORTAL (Malware_Distribution)"; content:"|03|q3o|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619560; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup u6x.ru IMMORTAL (Malware_Distribution)"; content:"|03|u6x|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619603; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup x8w.ru IMMORTAL (Malware_Distribution)"; content:"|03|x8w|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619653; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xb8.ru IMMORTAL (Malware_Distribution)"; content:"|03|xb8|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619666; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xd4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xd4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619670; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xf0.ru IMMORTAL (Malware_Distribution)"; content:"|03|xf0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619673; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xf9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xf9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619676; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xg0.ru IMMORTAL (Malware_Distribution)"; content:"|03|xg0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619677; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xh4.ru IMMORTAL (Malware_Distribution)"; content:"|03|xh4|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619682; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xq0.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq0|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619687; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xq9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xq9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619690; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xv9.ru IMMORTAL (Malware_Distribution)"; content:"|03|xv9|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619694; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup in-t-h-e.cn IMMORTAL (Malware_Distribution)"; content:"|08|in-t-h-e|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619901; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vht0.co.cc IMMORTAL (Malware_Infectors)"; content:"|04|vht0|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633835; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f6y.ru IMMORTAL (Malware_Distribution)"; content:"|03|f6y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619826; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup f7y.ru IMMORTAL (Malware_Distribution)"; content:"|03|f7y|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619830; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup lizamoon.com IMMORTAL (Malware_Distribution)"; content:"|08|lizamoon|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634118; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup eriflsaovdvdsa.co.cc IMMORTAL (Malware_Distribution)"; content:"|0e|eriflsaovdvdsa|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2631744; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup deonixion.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|09|deonixion|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628298; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wwwcfg.com IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|06|wwwcfg|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2620199; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup xepace.cn IMMORTAL (Zeus_Zbot_SpyEye)"; content:"|06|xepace|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2617663; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup onlinemacro.com IMMORTAL (Malware_Distribution)"; content:"|0b|onlinemacro|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634061; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup natursteindichtstoff.de IMMORTAL (Malware_Distribution)"; content:"|14|natursteindichtstoff|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628431; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 31ad.com IMMORTAL (Malware_Distribution)"; content:"|04|31ad|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2634519; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup iberostaronline.com IMMORTAL (Malware_Distribution)"; content:"|0f|iberostaronline|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628413; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup yandex-in.ru IMMORTAL (Malware_Distribution)"; content:"|09|yandex-in|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628659; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup trobermain.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|trobermain|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628779; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup uh.pl IMMORTAL (Malware_Distribution)"; content:"|02|uh|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629068; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup freexxpote.co.cc IMMORTAL (Malware_Distribution)"; content:"|0a|freexxpote|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635314; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup barbosogranul.ru IMMORTAL (Malware_Distribution)"; content:"|0d|barbosogranul|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635522; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup cache-3942.net IMMORTAL (Malware_Distribution)"; content:"|0a|cache-3942|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635590; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup goptres.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|goptres|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636023; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pushot.com IMMORTAL (Malware_Distribution)"; content:"|06|pushot|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2633010; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 7417788.ru IMMORTAL (Malware_Distribution)"; content:"|07|7417788|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627423; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a-z-uebersetzer.at IMMORTAL (Malware_Distribution)"; content:"|0f|a-z-uebersetzer|02|at"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627424; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aashaclinic.com IMMORTAL (Malware_Distribution)"; content:"|0b|aashaclinic|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627426; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adware2010.com IMMORTAL (Malware_Infectors)"; content:"|0a|adware2010|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627791; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup shop-hosting-bisingen.de IMMORTAL (Malware_Distribution)"; content:"|15|shop-hosting-bisingen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627879; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ati21.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|ati21|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628329; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup castleestateslondon.co.uk IMMORTAL (Malware_Distribution)"; content:"|13|castleestateslondon|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628383; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup livestro.nl IMMORTAL (Malware_Distribution)"; content:"|08|livestro|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628421; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup interactive.info.pl IMMORTAL (Malware_Distribution)"; content:"|0b|interactive|04|info|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629013; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kantum.net IMMORTAL (Malware_Distribution)"; content:"|06|kantum|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2635823; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup relaax.co.cc IMMORTAL (Malware_Distribution)"; content:"|06|relaax|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636095; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mylemoncity.com IMMORTAL (Malware_Distribution)"; content:"|0b|mylemoncity|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627325; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup paqtool.com IMMORTAL (Malware_Distribution)"; content:"|07|paqtool|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627339; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup best-med-shop.com IMMORTAL (Malware_Distribution)"; content:"|0d|best-med-shop|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627451; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup forgottencelebs.com IMMORTAL (Malware_Distribution)"; content:"|0f|forgottencelebs|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627467; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nabijarka.pl IMMORTAL (Malware_Distribution)"; content:"|09|nabijarka|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627489; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup odmarco.com IMMORTAL (Malware_Distribution)"; content:"|07|odmarco|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627490; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup trughtsa.com IMMORTAL (Malware_Distribution)"; content:"|08|trughtsa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627521; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup waipdns.ru IMMORTAL (Malware_Distribution)"; content:"|07|waipdns|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627709; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup womenzz.com IMMORTAL (Malware_Infectors)"; content:"|07|womenzz|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627716; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gsnjineh87.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0a|gsnjineh87|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629005; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alwasluae.net IMMORTAL (Malware_Distribution)"; content:"|09|alwasluae|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629083; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup tds-23vb8g5ff.co.cc IMMORTAL (Malware_Distribution)"; content:"|0d|tds-23vb8g5ff|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627380; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bustmiswoodckosnh.co.cc IMMORTAL ()"; content:"|11|bustmiswoodckosnh|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636160; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup chilibeans.co.uk IMMORTAL (Malware_Distribution)"; content:"|0a|chilibeans|02|co|02|uk"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636163; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup taeliterup.ru IMMORTAL (Spyware)"; content:"|0a|taeliterup|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2627690; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup wizard2.sbs.co.kr IMMORTAL (Malware_Infectors)"; content:"|07|wizard2|03|sbs|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628091; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup makerealcashnow.com IMMORTAL (Malware_Distribution)"; content:"|0f|makerealcashnow|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628424; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup proppera.co.cc IMMORTAL (Malware_Distribution)"; content:"|08|proppera|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628439; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ukuymfi.cn IMMORTAL (Malware_Distribution)"; content:"|07|ukuymfi|02|cn"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628782; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup abena.co.kr IMMORTAL (Malware_Distribution)"; content:"|05|abena|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629723; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup brookegypt.com IMMORTAL (Malware_Distribution)"; content:"|0a|brookegypt|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628200; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nt06.in IMMORTAL (Spyware)"; content:"|04|nt06|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628433; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nt07.in IMMORTAL (Spyware)"; content:"|04|nt07|02|in"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628434; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 108hao.com IMMORTAL (Malware_Distribution)"; content:"|06|108hao|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628791; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hss-klan.yoyo.pl IMMORTAL (Malware_Distribution)"; content:"|08|hss-klan|04|yoyo|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628840; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup 8addition.info IMMORTAL (Malware_Distribution)"; content:"|09|8addition|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636362; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup edunkp2.org IMMORTAL (Malware_Distribution)"; content:"|07|edunkp2|03|org"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636407; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup feksake.biz IMMORTAL (Malware_Distribution)"; content:"|07|feksake|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636422; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup globalwat.com IMMORTAL (Malware_Distribution)"; content:"|09|globalwat|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636444; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup gysh.es.kr IMMORTAL (Malware_Distribution)"; content:"|04|gysh|02|es|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629541; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup secguard.biz IMMORTAL (Malware_Distribution)"; content:"|08|secguard|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636516; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup semenov.ru IMMORTAL (Malware_Distribution)"; content:"|07|semenov|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636518; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup webunddesign.info IMMORTAL (Malware_Distribution)"; content:"|0c|webunddesign|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2636613; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup see.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|03|see|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628894; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup a1marketingteam.net IMMORTAL (Malware_Distribution)"; content:"|0f|a1marketingteam|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628936; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kolaaderinto.com IMMORTAL (Malware_Distribution)"; content:"|0c|kolaaderinto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628850; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup pwoot.fr IMMORTAL (Malware_Distribution)"; content:"|05|pwoot|02|fr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629042; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup vrsalesandnetworking.com IMMORTAL (Malware_Distribution)"; content:"|14|vrsalesandnetworking|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629074; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup abmarchitects.com IMMORTAL (Malware_Distribution)"; content:"|0d|abmarchitects|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628937; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bervb.com IMMORTAL (Malware_Distribution)"; content:"|05|bervb|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2645998; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hornalfa.com IMMORTAL (Malware_Distribution)"; content:"|08|hornalfa|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628546; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup namebrend.ru IMMORTAL (Malware_Distribution)"; content:"|09|namebrend|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646134; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup naurup.com IMMORTAL (Malware_Distribution)"; content:"|06|naurup|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628633; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup safe-all.com IMMORTAL (Malware_Distribution)"; content:"|08|safe-all|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628759; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup topwebvorlagen.de IMMORTAL (Malware_Distribution)"; content:"|0e|topwebvorlagen|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628653; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup duygusalforum.net IMMORTAL (Malware_Distribution)"; content:"|0d|duygusalforum|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629741; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup greensny.com IMMORTAL (Malware_Distribution)"; content:"|08|greensny|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629540; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup herkesbilmez.com IMMORTAL (Malware_Distribution)"; content:"|0c|herkesbilmez|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628722; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oneeyedflush.com IMMORTAL (Malware_Distribution)"; content:"|0c|oneeyedflush|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628747; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup planetnemo.com IMMORTAL (Malware_Distribution)"; content:"|0a|planetnemo|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628885; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup quadisiyya.com IMMORTAL (Malware_Distribution)"; content:"|0a|quadisiyya|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628756; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kentwoodprep.freehostia.com IMMORTAL (Malware_Distribution)"; content:"|0c|kentwoodprep|0a|freehostia|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628846; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup phonakfm.co.kr IMMORTAL (Malware_Distribution)"; content:"|08|phonakfm|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628881; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup alolipololi.osa.pl IMMORTAL (Malware_Distribution)"; content:"|0b|alolipololi|03|osa|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646208; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dltbkbb.co.cc IMMORTAL (Malware_Distribution)"; content:"|07|dltbkbb|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646249; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup haeied.net IMMORTAL (Malware_Distribution)"; content:"|06|haeied|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646292; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ivonica.com IMMORTAL (Malware_Distribution)"; content:"|07|ivonica|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646302; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup jackman-consortium.com IMMORTAL (Malware_Distribution)"; content:"|12|jackman-consortium|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646303; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup laiaed.net IMMORTAL (Malware_Distribution)"; content:"|06|laiaed|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646315; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup luxury-pride.ru IMMORTAL (Malware_Distribution)"; content:"|0c|luxury-pride|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646321; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mpnewsphoto.com IMMORTAL (Malware_Distribution)"; content:"|0b|mpnewsphoto|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646325; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nakulpi.net IMMORTAL (Malware_Distribution)"; content:"|07|nakulpi|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646329; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup protect-x.net IMMORTAL (Malware_Distribution)"; content:"|09|protect-x|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646338; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup requireapriest.com IMMORTAL (Malware_Distribution)"; content:"|0e|requireapriest|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646363; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup singaporeuniquetravel.com IMMORTAL (Malware_Distribution)"; content:"|15|singaporeuniquetravel|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629186; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dpsindirapuram.com IMMORTAL (Malware_Distribution)"; content:"|0e|dpsindirapuram|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628983; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup japaneseupskirts.com IMMORTAL (Malware_Distribution)"; content:"|10|japaneseupskirts|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628843; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup koilman.inodea.co.kr IMMORTAL (Malware_Distribution)"; content:"|07|koilman|06|inodea|02|co|02|kr"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619923; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ojcow.home.pl IMMORTAL (Malware_Distribution)"; content:"|05|ojcow|04|home|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629167; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup place4fun.nl IMMORTAL (Malware_Distribution)"; content:"|09|place4fun|02|nl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628882; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup qqywf.com IMMORTAL (Malware_Distribution)"; content:"|05|qqywf|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629359; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ralocredit.es IMMORTAL (Malware_Distribution)"; content:"|0a|ralocredit|02|es"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628889; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup aaimac.com IMMORTAL (Malware_Distribution)"; content:"|06|aaimac|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628792; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup adam-love.net IMMORTAL (Malware_Infectors)"; content:"|09|adam-love|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646615; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup air-komplex.hu IMMORTAL (Malware_Distribution)"; content:"|0b|air-komplex|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628795; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup andromari.cx.cc IMMORTAL (Malware_Distribution)"; content:"|09|andromari|02|cx|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646430; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup avi7o.co.cc IMMORTAL (Malware_Distribution)"; content:"|05|avi7o|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646431; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup badcobro.net IMMORTAL (Malware_Distribution)"; content:"|08|badcobro|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646614; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup dodawa-appliances.com IMMORTAL (Malware_Distribution)"; content:"|11|dodawa-appliances|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628981; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup ecoresearch.hu IMMORTAL (Malware_Distribution)"; content:"|0b|ecoresearch|02|hu"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628815; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup elysianuae.com IMMORTAL (Malware_Distribution)"; content:"|0a|elysianuae|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628816; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup extreme-channel.de IMMORTAL (Malware_Distribution)"; content:"|0f|extreme-channel|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628818; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup filmlerulkesi.com IMMORTAL (Malware_Distribution)"; content:"|0d|filmlerulkesi|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628821; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup highclass-escort.ro IMMORTAL (Malware_Distribution)"; content:"|10|highclass-escort|02|ro"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629543; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup hoon2008.com IMMORTAL (Malware_Distribution)"; content:"|08|hoon2008|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628834; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup it-friends.in.ua IMMORTAL (Malware_Distribution)"; content:"|0a|it-friends|02|in|02|ua"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628842; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kozusnictvomj.szm.com IMMORTAL (Malware_Distribution)"; content:"|0d|kozusnictvomj|03|szm|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628851; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup krainaseriali.jun.pl IMMORTAL (Malware_Distribution)"; content:"|0d|krainaseriali|03|jun|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619925; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup kravinec.com IMMORTAL (Malware_Distribution)"; content:"|08|kravinec|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628852; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mdsprojekt.com.pl IMMORTAL (Malware_Distribution)"; content:"|0a|mdsprojekt|03|com|02|pl"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628856; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup milenachocolates.com.ar IMMORTAL (Malware_Distribution)"; content:"|10|milenachocolates|03|com|02|ar"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628862; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mktdesigns.com IMMORTAL (Malware_Distribution)"; content:"|0a|mktdesigns|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628864; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mortgageccloan.com IMMORTAL (Malware_Distribution)"; content:"|0e|mortgageccloan|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629331; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup myinternetbusinessweblog.com IMMORTAL (Malware_Distribution)"; content:"|18|myinternetbusinessweblog|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628865; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nauticalspecialties.com IMMORTAL (Malware_Distribution)"; content:"|13|nauticalspecialties|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628869; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup nazarethnursery.com IMMORTAL (Malware_Distribution)"; content:"|0f|nazarethnursery|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628870; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup oksoocwc.com IMMORTAL (Malware_Distribution)"; content:"|08|oksoocwc|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628874; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup parfums.coolpage.biz IMMORTAL (Malware_Distribution)"; content:"|07|parfums|08|coolpage|03|biz"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628877; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup sirinflower.com IMMORTAL (Malware_Distribution)"; content:"|0b|sirinflower|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628897; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup bcdonline.de IMMORTAL (Malware_Distribution)"; content:"|09|bcdonline|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2628804; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup enjoy-party.info IMMORTAL (Malware_Distribution)"; content:"|0b|enjoy-party|04|info"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2619817; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup health-standard.com IMMORTAL (Malware_Distribution)"; content:"|0f|health-standard|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629282; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup mpcollection.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|0c|mpcollection|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629159; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup time-sharing.de IMMORTAL (Malware_Distribution)"; content:"|0c|time-sharing|02|de"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629197; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup googlesyndioation.com IMMORTAL (Malware_Distribution)"; content:"|11|googlesyndioation|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2629436; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup e-website-development.com IMMORTAL (Malware_Distribution)"; content:"|15|e-website-development|03|com"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646694; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup funnys.webphoto.ir IMMORTAL (Malware_Distribution)"; content:"|06|funnys|08|webphoto|02|ir"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646699; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup karbjurator.co.cc IMMORTAL (Malware_Distribution)"; content:"|0b|karbjurator|02|co|02|cc"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646710; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup quake2012.ru IMMORTAL (Malware_Distribution)"; content:"|09|quake2012|02|ru"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646781; rev:8;) alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"SPYWARE-DNS DNS lookup zoomt.net IMMORTAL (Malware_Distribution)"; content:"|05|zoomt|03|net"; nocase; tag: host,10,packets,src; classtype:trojan-activity; reference:url,www.malwaredomains.com; sid:2646872; rev:8;) # Error on # Defective domain declaration: q.gs iframe sucuri.net/global 20120218