alert tcp $HOME_NET any -> 12.168.253.2 5860 (msg: "Storm worm phone home address 12.168.253.2\:5860"; sid: 1055001; rev: 1;)
alert tcp $HOME_NET any -> 12.18.11.65 4479 (msg: "Storm worm phone home address 12.18.11.65\:4479"; sid: 1055002; rev: 1;)
alert tcp $HOME_NET any -> 12.226.63.204 18336 (msg: "Storm worm phone home address 12.226.63.204\:18336"; sid: 1055003; rev: 1;)
alert tcp $HOME_NET any -> 24.109.90.185 16338 (msg: "Storm worm phone home address 24.109.90.185\:16338"; sid: 1055004; rev: 1;)
alert tcp $HOME_NET any -> 24.129.71.144 14185 (msg: "Storm worm phone home address 24.129.71.144\:14185"; sid: 1055005; rev: 1;)
alert tcp $HOME_NET any -> 24.132.198.197 15407 (msg: "Storm worm phone home address 24.132.198.197\:15407"; sid: 1055006; rev: 1;)
alert tcp $HOME_NET any -> 24.14.10.145 33339 (msg: "Storm worm phone home address 24.14.10.145\:33339"; sid: 1055007; rev: 1;)
alert tcp $HOME_NET any -> 24.14.188.144 28638 (msg: "Storm worm phone home address 24.14.188.144\:28638"; sid: 1055008; rev: 1;)
alert tcp $HOME_NET any -> 24.144.237.191 26009 (msg: "Storm worm phone home address 24.144.237.191\:26009"; sid: 1055009; rev: 1;)
alert tcp $HOME_NET any -> 24.152.227.111 11547 (msg: "Storm worm phone home address 24.152.227.111\:11547"; sid: 1055010; rev: 1;)
alert tcp $HOME_NET any -> 24.155.140.51 8446 (msg: "Storm worm phone home address 24.155.140.51\:8446"; sid: 1055011; rev: 1;)
alert tcp $HOME_NET any -> 24.158.0.218 31276 (msg: "Storm worm phone home address 24.158.0.218\:31276"; sid: 1055012; rev: 1;)
alert tcp $HOME_NET any -> 24.158.74.6 27347 (msg: "Storm worm phone home address 24.158.74.6\:27347"; sid: 1055013; rev: 1;)
alert tcp $HOME_NET any -> 24.165.123.157 13258 (msg: "Storm worm phone home address 24.165.123.157\:13258"; sid: 1055014; rev: 1;)
alert tcp $HOME_NET any -> 24.171.222.194 8901 (msg: "Storm worm phone home address 24.171.222.194\:8901"; sid: 1055015; rev: 1;)
alert tcp $HOME_NET any -> 24.180.18.241 4989 (msg: "Storm worm phone home address 24.180.18.241\:4989"; sid: 1055016; rev: 1;)
alert tcp $HOME_NET any -> 24.185.153.173 9330 (msg: "Storm worm phone home address 24.185.153.173\:9330"; sid: 1055017; rev: 1;)
alert tcp $HOME_NET any -> 24.185.2.110 3973 (msg: "Storm worm phone home address 24.185.2.110\:3973"; sid: 1055018; rev: 1;)
alert tcp $HOME_NET any -> 24.188.5.180 11873 (msg: "Storm worm phone home address 24.188.5.180\:11873"; sid: 1055019; rev: 1;)
alert tcp $HOME_NET any -> 24.189.70.231 13258 (msg: "Storm worm phone home address 24.189.70.231\:13258"; sid: 1055020; rev: 1;)
alert tcp $HOME_NET any -> 24.20.13.255 4861 (msg: "Storm worm phone home address 24.20.13.255\:4861"; sid: 1055021; rev: 1;)
alert tcp $HOME_NET any -> 24.218.204.202 26854 (msg: "Storm worm phone home address 24.218.204.202\:26854"; sid: 1055022; rev: 1;)
alert tcp $HOME_NET any -> 24.224.166.178 12165 (msg: "Storm worm phone home address 24.224.166.178\:12165"; sid: 1055023; rev: 1;)
alert tcp $HOME_NET any -> 24.248.68.118 9630 (msg: "Storm worm phone home address 24.248.68.118\:9630"; sid: 1055024; rev: 1;)
alert tcp $HOME_NET any -> 24.31.30.239 2506 (msg: "Storm worm phone home address 24.31.30.239\:2506"; sid: 1055025; rev: 1;)
alert tcp $HOME_NET any -> 24.4.39.107 28591 (msg: "Storm worm phone home address 24.4.39.107\:28591"; sid: 1055026; rev: 1;)
alert tcp $HOME_NET any -> 24.46.187.113 13434 (msg: "Storm worm phone home address 24.46.187.113\:13434"; sid: 1055027; rev: 1;)
alert tcp $HOME_NET any -> 24.5.159.169 24023 (msg: "Storm worm phone home address 24.5.159.169\:24023"; sid: 1055028; rev: 1;)
alert tcp $HOME_NET any -> 24.7.220.112 19027 (msg: "Storm worm phone home address 24.7.220.112\:19027"; sid: 1055029; rev: 1;)
alert tcp $HOME_NET any -> 24.76.174.112 24135 (msg: "Storm worm phone home address 24.76.174.112\:24135"; sid: 1055030; rev: 1;)
alert tcp $HOME_NET any -> 24.8.196.137 21407 (msg: "Storm worm phone home address 24.8.196.137\:21407"; sid: 1055031; rev: 1;)
alert tcp $HOME_NET any -> 24.81.109.149 33742 (msg: "Storm worm phone home address 24.81.109.149\:33742"; sid: 1055032; rev: 1;)
alert tcp $HOME_NET any -> 41.196.57.227 17041 (msg: "Storm worm phone home address 41.196.57.227\:17041"; sid: 1055033; rev: 1;)
alert tcp $HOME_NET any -> 41.232.246.96 5843 (msg: "Storm worm phone home address 41.232.246.96\:5843"; sid: 1055034; rev: 1;)
alert tcp $HOME_NET any -> 41.232.246.89 32404 (msg: "Storm worm phone home address 41.232.246.89\:32404"; sid: 1055035; rev: 1;)
alert tcp $HOME_NET any -> 41.233.10.45 31143 (msg: "Storm worm phone home address 41.233.10.45\:31143"; sid: 1055036; rev: 1;)
alert tcp $HOME_NET any -> 41.240.44.124 15004 (msg: "Storm worm phone home address 41.240.44.124\:15004"; sid: 1055037; rev: 1;)
alert tcp $HOME_NET any -> 41.242.14.72 9604 (msg: "Storm worm phone home address 41.242.14.72\:9604"; sid: 1055038; rev: 1;)
alert tcp $HOME_NET any -> 41.249.105.160 2472 (msg: "Storm worm phone home address 41.249.105.160\:2472"; sid: 1055039; rev: 1;)
alert tcp $HOME_NET any -> 41.249.110.155 25709 (msg: "Storm worm phone home address 41.249.110.155\:25709"; sid: 1055040; rev: 1;)
alert tcp $HOME_NET any -> 41.251.30.155 9566 (msg: "Storm worm phone home address 41.251.30.155\:9566"; sid: 1055041; rev: 1;)
alert tcp $HOME_NET any -> 41.251.72.133 28883 (msg: "Storm worm phone home address 41.251.72.133\:28883"; sid: 1055042; rev: 1;)
alert tcp $HOME_NET any -> 58.103.98.25 30530 (msg: "Storm worm phone home address 58.103.98.25\:30530"; sid: 1055043; rev: 1;)
alert tcp $HOME_NET any -> 58.182.116.50 6808 (msg: "Storm worm phone home address 58.182.116.50\:6808"; sid: 1055044; rev: 1;)
alert tcp $HOME_NET any -> 58.9.144.16 27570 (msg: "Storm worm phone home address 58.9.144.16\:27570"; sid: 1055045; rev: 1;)
alert tcp $HOME_NET any -> 59.144.160.210 8832 (msg: "Storm worm phone home address 59.144.160.210\:8832"; sid: 1055046; rev: 1;)
alert tcp $HOME_NET any -> 59.164.100.221 22591 (msg: "Storm worm phone home address 59.164.100.221\:22591"; sid: 1055047; rev: 1;)
alert tcp $HOME_NET any -> 59.4.179.8 16286 (msg: "Storm worm phone home address 59.4.179.8\:16286"; sid: 1055048; rev: 1;)
alert tcp $HOME_NET any -> 60.49.125.204 14219 (msg: "Storm worm phone home address 60.49.125.204\:14219"; sid: 1055049; rev: 1;)
alert tcp $HOME_NET any -> 61.10.208.214 12392 (msg: "Storm worm phone home address 61.10.208.214\:12392"; sid: 1055050; rev: 1;)
alert tcp $HOME_NET any -> 61.58.70.136 10921 (msg: "Storm worm phone home address 61.58.70.136\:10921"; sid: 1055051; rev: 1;)
alert tcp $HOME_NET any -> 62.140.253.9 25829 (msg: "Storm worm phone home address 62.140.253.9\:25829"; sid: 1055052; rev: 1;)
alert tcp $HOME_NET any -> 62.143.1.225 28758 (msg: "Storm worm phone home address 62.143.1.225\:28758"; sid: 1055053; rev: 1;)
alert tcp $HOME_NET any -> 62.30.173.111 19936 (msg: "Storm worm phone home address 62.30.173.111\:19936"; sid: 1055054; rev: 1;)
alert tcp $HOME_NET any -> 64.135.204.224 18053 (msg: "Storm worm phone home address 64.135.204.224\:18053"; sid: 1055055; rev: 1;)
alert tcp $HOME_NET any -> 64.194.39.190 18954 (msg: "Storm worm phone home address 64.194.39.190\:18954"; sid: 1055056; rev: 1;)
alert tcp $HOME_NET any -> 65.107.41.146 33326 (msg: "Storm worm phone home address 65.107.41.146\:33326"; sid: 1055057; rev: 1;)
alert tcp $HOME_NET any -> 65.92.191.184 24461 (msg: "Storm worm phone home address 65.92.191.184\:24461"; sid: 1055058; rev: 1;)
alert tcp $HOME_NET any -> 66.109.153.138 1511 (msg: "Storm worm phone home address 66.109.153.138\:1511"; sid: 1055059; rev: 1;)
alert tcp $HOME_NET any -> 66.133.225.20 32970 (msg: "Storm worm phone home address 66.133.225.20\:32970"; sid: 1055060; rev: 1;)
alert tcp $HOME_NET any -> 66.138.99.186 12864 (msg: "Storm worm phone home address 66.138.99.186\:12864"; sid: 1055061; rev: 1;)
alert tcp $HOME_NET any -> 66.150.62.168 23783 (msg: "Storm worm phone home address 66.150.62.168\:23783"; sid: 1055062; rev: 1;)
alert tcp $HOME_NET any -> 66.161.195.226 16711 (msg: "Storm worm phone home address 66.161.195.226\:16711"; sid: 1055063; rev: 1;)
alert tcp $HOME_NET any -> 66.49.61.66 28986 (msg: "Storm worm phone home address 66.49.61.66\:28986"; sid: 1055064; rev: 1;)
alert tcp $HOME_NET any -> 66.90.147.47 13391 (msg: "Storm worm phone home address 66.90.147.47\:13391"; sid: 1055065; rev: 1;)
alert tcp $HOME_NET any -> 66.94.95.73 27613 (msg: "Storm worm phone home address 66.94.95.73\:27613"; sid: 1055066; rev: 1;)
alert tcp $HOME_NET any -> 67.120.62.59 3527 (msg: "Storm worm phone home address 67.120.62.59\:3527"; sid: 1055067; rev: 1;)
alert tcp $HOME_NET any -> 67.165.202.142 5337 (msg: "Storm worm phone home address 67.165.202.142\:5337"; sid: 1055068; rev: 1;)
alert tcp $HOME_NET any -> 67.167.223.69 19636 (msg: "Storm worm phone home address 67.167.223.69\:19636"; sid: 1055069; rev: 1;)
alert tcp $HOME_NET any -> 67.169.119.102 8429 (msg: "Storm worm phone home address 67.169.119.102\:8429"; sid: 1055070; rev: 1;)
alert tcp $HOME_NET any -> 67.173.12.144 10342 (msg: "Storm worm phone home address 67.173.12.144\:10342"; sid: 1055071; rev: 1;)
alert tcp $HOME_NET any -> 67.182.38.28 8665 (msg: "Storm worm phone home address 67.182.38.28\:8665"; sid: 1055072; rev: 1;)
alert tcp $HOME_NET any -> 67.188.116.221 19254 (msg: "Storm worm phone home address 67.188.116.221\:19254"; sid: 1055073; rev: 1;)
alert tcp $HOME_NET any -> 67.38.136.132 30530 (msg: "Storm worm phone home address 67.38.136.132\:30530"; sid: 1055074; rev: 1;)
alert tcp $HOME_NET any -> 67.40.210.13 11620 (msg: "Storm worm phone home address 67.40.210.13\:11620"; sid: 1055075; rev: 1;)
alert tcp $HOME_NET any -> 67.49.159.66 19400 (msg: "Storm worm phone home address 67.49.159.66\:19400"; sid: 1055076; rev: 1;)
alert tcp $HOME_NET any -> 67.71.53.209 16638 (msg: "Storm worm phone home address 67.71.53.209\:16638"; sid: 1055077; rev: 1;)
alert tcp $HOME_NET any -> 67.77.90.97 29745 (msg: "Storm worm phone home address 67.77.90.97\:29745"; sid: 1055078; rev: 1;)
alert tcp $HOME_NET any -> 67.84.3.188 26009 (msg: "Storm worm phone home address 67.84.3.188\:26009"; sid: 1055079; rev: 1;)
alert tcp $HOME_NET any -> 67.87.45.70 4672 (msg: "Storm worm phone home address 67.87.45.70\:4672"; sid: 1055080; rev: 1;)
alert tcp $HOME_NET any -> 67.91.54.36 9720 (msg: "Storm worm phone home address 67.91.54.36\:9720"; sid: 1055081; rev: 1;)
alert tcp $HOME_NET any -> 68.115.106.252 14807 (msg: "Storm worm phone home address 68.115.106.252\:14807"; sid: 1055082; rev: 1;)
alert tcp $HOME_NET any -> 68.14.149.96 16196 (msg: "Storm worm phone home address 68.14.149.96\:16196"; sid: 1055083; rev: 1;)
alert tcp $HOME_NET any -> 68.150.247.162 23959 (msg: "Storm worm phone home address 68.150.247.162\:23959"; sid: 1055084; rev: 1;)
alert tcp $HOME_NET any -> 68.187.154.4 8103 (msg: "Storm worm phone home address 68.187.154.4\:8103"; sid: 1055085; rev: 1;)
alert tcp $HOME_NET any -> 68.192.231.202 4110 (msg: "Storm worm phone home address 68.192.231.202\:4110"; sid: 1055086; rev: 1;)
alert tcp $HOME_NET any -> 68.192.60.208 22921 (msg: "Storm worm phone home address 68.192.60.208\:22921"; sid: 1055087; rev: 1;)
alert tcp $HOME_NET any -> 68.193.183.96 29046 (msg: "Storm worm phone home address 68.193.183.96\:29046"; sid: 1055088; rev: 1;)
alert tcp $HOME_NET any -> 68.194.152.183 11757 (msg: "Storm worm phone home address 68.194.152.183\:11757"; sid: 1055089; rev: 1;)
alert tcp $HOME_NET any -> 68.197.162.201 18366 (msg: "Storm worm phone home address 68.197.162.201\:18366"; sid: 1055090; rev: 1;)
alert tcp $HOME_NET any -> 68.203.75.136 23363 (msg: "Storm worm phone home address 68.203.75.136\:23363"; sid: 1055091; rev: 1;)
alert tcp $HOME_NET any -> 68.230.17.32 9450 (msg: "Storm worm phone home address 68.230.17.32\:9450"; sid: 1055092; rev: 1;)
alert tcp $HOME_NET any -> 68.238.147.2 13061 (msg: "Storm worm phone home address 68.238.147.2\:13061"; sid: 1055093; rev: 1;)
alert tcp $HOME_NET any -> 68.33.84.145 28707 (msg: "Storm worm phone home address 68.33.84.145\:28707"; sid: 1055094; rev: 1;)
alert tcp $HOME_NET any -> 68.36.150.190 15750 (msg: "Storm worm phone home address 68.36.150.190\:15750"; sid: 1055095; rev: 1;)
alert tcp $HOME_NET any -> 68.36.219.15 26944 (msg: "Storm worm phone home address 68.36.219.15\:26944"; sid: 1055096; rev: 1;)
alert tcp $HOME_NET any -> 68.53.9.56 14219 (msg: "Storm worm phone home address 68.53.9.56\:14219"; sid: 1055097; rev: 1;)
alert tcp $HOME_NET any -> 68.7.72.252 11526 (msg: "Storm worm phone home address 68.7.72.252\:11526"; sid: 1055098; rev: 1;)
alert tcp $HOME_NET any -> 68.82.90.240 33043 (msg: "Storm worm phone home address 68.82.90.240\:33043"; sid: 1055099; rev: 1;)
alert tcp $HOME_NET any -> 69.118.21.8 10432 (msg: "Storm worm phone home address 69.118.21.8\:10432"; sid: 1055100; rev: 1;)
alert tcp $HOME_NET any -> 69.119.51.213 24375 (msg: "Storm worm phone home address 69.119.51.213\:24375"; sid: 1055101; rev: 1;)
alert tcp $HOME_NET any -> 69.122.229.18 16925 (msg: "Storm worm phone home address 69.122.229.18\:16925"; sid: 1055102; rev: 1;)
alert tcp $HOME_NET any -> 69.123.33.170 10934 (msg: "Storm worm phone home address 69.123.33.170\:10934"; sid: 1055103; rev: 1;)
alert tcp $HOME_NET any -> 69.123.221.92 13100 (msg: "Storm worm phone home address 69.123.221.92\:13100"; sid: 1055104; rev: 1;)
alert tcp $HOME_NET any -> 69.14.108.253 16655 (msg: "Storm worm phone home address 69.14.108.253\:16655"; sid: 1055105; rev: 1;)
alert tcp $HOME_NET any -> 69.143.121.120 8798 (msg: "Storm worm phone home address 69.143.121.120\:8798"; sid: 1055106; rev: 1;)
alert tcp $HOME_NET any -> 69.144.130.235 21733 (msg: "Storm worm phone home address 69.144.130.235\:21733"; sid: 1055107; rev: 1;)
alert tcp $HOME_NET any -> 69.149.123.168 3969 (msg: "Storm worm phone home address 69.149.123.168\:3969"; sid: 1055108; rev: 1;)
alert tcp $HOME_NET any -> 69.180.112.86 24165 (msg: "Storm worm phone home address 69.180.112.86\:24165"; sid: 1055109; rev: 1;)
alert tcp $HOME_NET any -> 69.228.103.249 6362 (msg: "Storm worm phone home address 69.228.103.249\:6362"; sid: 1055110; rev: 1;)
alert tcp $HOME_NET any -> 69.248.203.105 11268 (msg: "Storm worm phone home address 69.248.203.105\:11268"; sid: 1055111; rev: 1;)
alert tcp $HOME_NET any -> 69.26.61.214 31713 (msg: "Storm worm phone home address 69.26.61.214\:31713"; sid: 1055112; rev: 1;)
alert tcp $HOME_NET any -> 69.77.212.243 25203 (msg: "Storm worm phone home address 69.77.212.243\:25203"; sid: 1055113; rev: 1;)
alert tcp $HOME_NET any -> 69.94.175.73 6628 (msg: "Storm worm phone home address 69.94.175.73\:6628"; sid: 1055114; rev: 1;)
alert tcp $HOME_NET any -> 70.141.161.130 26567 (msg: "Storm worm phone home address 70.141.161.130\:26567"; sid: 1055115; rev: 1;)
alert tcp $HOME_NET any -> 70.162.59.147 15180 (msg: "Storm worm phone home address 70.162.59.147\:15180"; sid: 1055116; rev: 1;)
alert tcp $HOME_NET any -> 70.177.15.27 33489 (msg: "Storm worm phone home address 70.177.15.27\:33489"; sid: 1055117; rev: 1;)
alert tcp $HOME_NET any -> 70.184.16.230 18336 (msg: "Storm worm phone home address 70.184.16.230\:18336"; sid: 1055118; rev: 1;)
alert tcp $HOME_NET any -> 70.197.153.39 33742 (msg: "Storm worm phone home address 70.197.153.39\:33742"; sid: 1055119; rev: 1;)
alert tcp $HOME_NET any -> 70.232.82.16 2236 (msg: "Storm worm phone home address 70.232.82.16\:2236"; sid: 1055120; rev: 1;)
alert tcp $HOME_NET any -> 70.247.26.71 10925 (msg: "Storm worm phone home address 70.247.26.71\:10925"; sid: 1055121; rev: 1;)
alert tcp $HOME_NET any -> 70.44.234.126 3844 (msg: "Storm worm phone home address 70.44.234.126\:3844"; sid: 1055122; rev: 1;)
alert tcp $HOME_NET any -> 70.54.118.184 29050 (msg: "Storm worm phone home address 70.54.118.184\:29050"; sid: 1055123; rev: 1;)
alert tcp $HOME_NET any -> 70.62.193.45 14112 (msg: "Storm worm phone home address 70.62.193.45\:14112"; sid: 1055124; rev: 1;)
alert tcp $HOME_NET any -> 70.63.192.190 12615 (msg: "Storm worm phone home address 70.63.192.190\:12615"; sid: 1055125; rev: 1;)
alert tcp $HOME_NET any -> 70.71.150.147 9956 (msg: "Storm worm phone home address 70.71.150.147\:9956"; sid: 1055126; rev: 1;)
alert tcp $HOME_NET any -> 70.82.179.237 31546 (msg: "Storm worm phone home address 70.82.179.237\:31546"; sid: 1055127; rev: 1;)
alert tcp $HOME_NET any -> 71.10.6.35 28385 (msg: "Storm worm phone home address 71.10.6.35\:28385"; sid: 1055128; rev: 1;)
alert tcp $HOME_NET any -> 71.110.226.197 14918 (msg: "Storm worm phone home address 71.110.226.197\:14918"; sid: 1055129; rev: 1;)
alert tcp $HOME_NET any -> 71.119.236.246 10741 (msg: "Storm worm phone home address 71.119.236.246\:10741"; sid: 1055130; rev: 1;)
alert tcp $HOME_NET any -> 71.125.59.172 24881 (msg: "Storm worm phone home address 71.125.59.172\:24881"; sid: 1055131; rev: 1;)
alert tcp $HOME_NET any -> 71.14.92.230 14056 (msg: "Storm worm phone home address 71.14.92.230\:14056"; sid: 1055132; rev: 1;)
alert tcp $HOME_NET any -> 71.153.160.147 11161 (msg: "Storm worm phone home address 71.153.160.147\:11161"; sid: 1055133; rev: 1;)
alert tcp $HOME_NET any -> 71.170.48.249 13627 (msg: "Storm worm phone home address 71.170.48.249\:13627"; sid: 1055134; rev: 1;)
alert tcp $HOME_NET any -> 71.173.132.161 1155 (msg: "Storm worm phone home address 71.173.132.161\:1155"; sid: 1055135; rev: 1;)
alert tcp $HOME_NET any -> 71.175.84.12 22248 (msg: "Storm worm phone home address 71.175.84.12\:22248"; sid: 1055136; rev: 1;)
alert tcp $HOME_NET any -> 71.177.147.103 8742 (msg: "Storm worm phone home address 71.177.147.103\:8742"; sid: 1055137; rev: 1;)
alert tcp $HOME_NET any -> 71.180.201.244 21064 (msg: "Storm worm phone home address 71.180.201.244\:21064"; sid: 1055138; rev: 1;)
alert tcp $HOME_NET any -> 71.180.115.140 22801 (msg: "Storm worm phone home address 71.180.115.140\:22801"; sid: 1055139; rev: 1;)
alert tcp $HOME_NET any -> 71.182.157.185 15360 (msg: "Storm worm phone home address 71.182.157.185\:15360"; sid: 1055140; rev: 1;)
alert tcp $HOME_NET any -> 71.183.173.88 6375 (msg: "Storm worm phone home address 71.183.173.88\:6375"; sid: 1055141; rev: 1;)
alert tcp $HOME_NET any -> 71.188.92.144 13108 (msg: "Storm worm phone home address 71.188.92.144\:13108"; sid: 1055142; rev: 1;)
alert tcp $HOME_NET any -> 71.192.225.17 2592 (msg: "Storm worm phone home address 71.192.225.17\:2592"; sid: 1055143; rev: 1;)
alert tcp $HOME_NET any -> 71.201.219.88 27489 (msg: "Storm worm phone home address 71.201.219.88\:27489"; sid: 1055144; rev: 1;)
alert tcp $HOME_NET any -> 71.209.125.235 26005 (msg: "Storm worm phone home address 71.209.125.235\:26005"; sid: 1055145; rev: 1;)
alert tcp $HOME_NET any -> 71.216.58.30 16385 (msg: "Storm worm phone home address 71.216.58.30\:16385"; sid: 1055146; rev: 1;)
alert tcp $HOME_NET any -> 71.226.144.63 13567 (msg: "Storm worm phone home address 71.226.144.63\:13567"; sid: 1055147; rev: 1;)
alert tcp $HOME_NET any -> 71.226.23.158 27399 (msg: "Storm worm phone home address 71.226.23.158\:27399"; sid: 1055148; rev: 1;)
alert tcp $HOME_NET any -> 71.238.112.45 28557 (msg: "Storm worm phone home address 71.238.112.45\:28557"; sid: 1055149; rev: 1;)
alert tcp $HOME_NET any -> 71.239.26.221 19413 (msg: "Storm worm phone home address 71.239.26.221\:19413"; sid: 1055150; rev: 1;)
alert tcp $HOME_NET any -> 71.239.40.106 3291 (msg: "Storm worm phone home address 71.239.40.106\:3291"; sid: 1055151; rev: 1;)
alert tcp $HOME_NET any -> 71.56.133.221 1756 (msg: "Storm worm phone home address 71.56.133.221\:1756"; sid: 1055152; rev: 1;)
alert tcp $HOME_NET any -> 71.59.130.23 27467 (msg: "Storm worm phone home address 71.59.130.23\:27467"; sid: 1055153; rev: 1;)
alert tcp $HOME_NET any -> 71.59.169.246 12997 (msg: "Storm worm phone home address 71.59.169.246\:12997"; sid: 1055154; rev: 1;)
alert tcp $HOME_NET any -> 71.59.190.130 20279 (msg: "Storm worm phone home address 71.59.190.130\:20279"; sid: 1055155; rev: 1;)
alert tcp $HOME_NET any -> 71.6.60.170 2043 (msg: "Storm worm phone home address 71.6.60.170\:2043"; sid: 1055156; rev: 1;)
alert tcp $HOME_NET any -> 71.79.114.242 25709 (msg: "Storm worm phone home address 71.79.114.242\:25709"; sid: 1055157; rev: 1;)
alert tcp $HOME_NET any -> 71.83.92.45 26228 (msg: "Storm worm phone home address 71.83.92.45\:26228"; sid: 1055158; rev: 1;)
alert tcp $HOME_NET any -> 71.89.154.90 4106 (msg: "Storm worm phone home address 71.89.154.90\:4106"; sid: 1055159; rev: 1;)
alert tcp $HOME_NET any -> 71.91.35.147 1181 (msg: "Storm worm phone home address 71.91.35.147\:1181"; sid: 1055160; rev: 1;)
alert tcp $HOME_NET any -> 71.98.246.80 20957 (msg: "Storm worm phone home address 71.98.246.80\:20957"; sid: 1055161; rev: 1;)
alert tcp $HOME_NET any -> 72.188.252.245 26331 (msg: "Storm worm phone home address 72.188.252.245\:26331"; sid: 1055162; rev: 1;)
alert tcp $HOME_NET any -> 72.193.132.40 7164 (msg: "Storm worm phone home address 72.193.132.40\:7164"; sid: 1055163; rev: 1;)
alert tcp $HOME_NET any -> 72.24.34.97 8485 (msg: "Storm worm phone home address 72.24.34.97\:8485"; sid: 1055164; rev: 1;)
alert tcp $HOME_NET any -> 72.53.147.189 10020 (msg: "Storm worm phone home address 72.53.147.189\:10020"; sid: 1055165; rev: 1;)
alert tcp $HOME_NET any -> 72.54.124.197 26417 (msg: "Storm worm phone home address 72.54.124.197\:26417"; sid: 1055166; rev: 1;)
alert tcp $HOME_NET any -> 72.87.164.51 13374 (msg: "Storm worm phone home address 72.87.164.51\:13374"; sid: 1055167; rev: 1;)
alert tcp $HOME_NET any -> 72.91.141.124 7897 (msg: "Storm worm phone home address 72.91.141.124\:7897"; sid: 1055168; rev: 1;)
alert tcp $HOME_NET any -> 72.92.231.4 8579 (msg: "Storm worm phone home address 72.92.231.4\:8579"; sid: 1055169; rev: 1;)
alert tcp $HOME_NET any -> 74.128.214.59 29406 (msg: "Storm worm phone home address 74.128.214.59\:29406"; sid: 1055170; rev: 1;)
alert tcp $HOME_NET any -> 74.138.237.32 9939 (msg: "Storm worm phone home address 74.138.237.32\:9939"; sid: 1055171; rev: 1;)
alert tcp $HOME_NET any -> 74.140.204.90 21407 (msg: "Storm worm phone home address 74.140.204.90\:21407"; sid: 1055172; rev: 1;)
alert tcp $HOME_NET any -> 74.143.27.130 32567 (msg: "Storm worm phone home address 74.143.27.130\:32567"; sid: 1055173; rev: 1;)
alert tcp $HOME_NET any -> 74.192.183.26 15004 (msg: "Storm worm phone home address 74.192.183.26\:15004"; sid: 1055174; rev: 1;)
alert tcp $HOME_NET any -> 74.195.222.245 5607 (msg: "Storm worm phone home address 74.195.222.245\:5607"; sid: 1055175; rev: 1;)
alert tcp $HOME_NET any -> 74.62.169.218 29020 (msg: "Storm worm phone home address 74.62.169.218\:29020"; sid: 1055176; rev: 1;)
alert tcp $HOME_NET any -> 74.72.137.95 25812 (msg: "Storm worm phone home address 74.72.137.95\:25812"; sid: 1055177; rev: 1;)
alert tcp $HOME_NET any -> 74.78.72.123 9806 (msg: "Storm worm phone home address 74.78.72.123\:9806"; sid: 1055178; rev: 1;)
alert tcp $HOME_NET any -> 74.78.84.193 26417 (msg: "Storm worm phone home address 74.78.84.193\:26417"; sid: 1055179; rev: 1;)
alert tcp $HOME_NET any -> 75.10.101.24 22252 (msg: "Storm worm phone home address 75.10.101.24\:22252"; sid: 1055180; rev: 1;)
alert tcp $HOME_NET any -> 75.128.124.194 25709 (msg: "Storm worm phone home address 75.128.124.194\:25709"; sid: 1055181; rev: 1;)
alert tcp $HOME_NET any -> 75.131.237.217 10775 (msg: "Storm worm phone home address 75.131.237.217\:10775"; sid: 1055182; rev: 1;)
alert tcp $HOME_NET any -> 75.133.92.82 22904 (msg: "Storm worm phone home address 75.133.92.82\:22904"; sid: 1055183; rev: 1;)
alert tcp $HOME_NET any -> 75.146.211.185 28883 (msg: "Storm worm phone home address 75.146.211.185\:28883"; sid: 1055184; rev: 1;)
alert tcp $HOME_NET any -> 75.147.73.170 32104 (msg: "Storm worm phone home address 75.147.73.170\:32104"; sid: 1055185; rev: 1;)
alert tcp $HOME_NET any -> 75.169.97.246 33742 (msg: "Storm worm phone home address 75.169.97.246\:33742"; sid: 1055186; rev: 1;)
alert tcp $HOME_NET any -> 75.183.51.115 7185 (msg: "Storm worm phone home address 75.183.51.115\:7185"; sid: 1055187; rev: 1;)
alert tcp $HOME_NET any -> 75.186.84.109 1554 (msg: "Storm worm phone home address 75.186.84.109\:1554"; sid: 1055188; rev: 1;)
alert tcp $HOME_NET any -> 75.21.225.11 5041 (msg: "Storm worm phone home address 75.21.225.11\:5041"; sid: 1055189; rev: 1;)
alert tcp $HOME_NET any -> 75.24.250.245 26417 (msg: "Storm worm phone home address 75.24.250.245\:26417"; sid: 1055190; rev: 1;)
alert tcp $HOME_NET any -> 75.26.18.60 7524 (msg: "Storm worm phone home address 75.26.18.60\:7524"; sid: 1055191; rev: 1;)
alert tcp $HOME_NET any -> 75.41.254.23 1301 (msg: "Storm worm phone home address 75.41.254.23\:1301"; sid: 1055192; rev: 1;)
alert tcp $HOME_NET any -> 75.51.131.5 23955 (msg: "Storm worm phone home address 75.51.131.5\:23955"; sid: 1055193; rev: 1;)
alert tcp $HOME_NET any -> 75.56.141.142 10921 (msg: "Storm worm phone home address 75.56.141.142\:10921"; sid: 1055194; rev: 1;)
alert tcp $HOME_NET any -> 75.72.104.22 1215 (msg: "Storm worm phone home address 75.72.104.22\:1215"; sid: 1055195; rev: 1;)
alert tcp $HOME_NET any -> 75.92.68.56 5178 (msg: "Storm worm phone home address 75.92.68.56\:5178"; sid: 1055196; rev: 1;)
alert tcp $HOME_NET any -> 75.92.116.177 15536 (msg: "Storm worm phone home address 75.92.116.177\:15536"; sid: 1055197; rev: 1;)
alert tcp $HOME_NET any -> 76.104.93.121 29333 (msg: "Storm worm phone home address 76.104.93.121\:29333"; sid: 1055198; rev: 1;)
alert tcp $HOME_NET any -> 76.106.33.8 8609 (msg: "Storm worm phone home address 76.106.33.8\:8609"; sid: 1055199; rev: 1;)
alert tcp $HOME_NET any -> 76.108.220.191 8819 (msg: "Storm worm phone home address 76.108.220.191\:8819"; sid: 1055200; rev: 1;)
alert tcp $HOME_NET any -> 76.114.240.118 31499 (msg: "Storm worm phone home address 76.114.240.118\:31499"; sid: 1055201; rev: 1;)
alert tcp $HOME_NET any -> 76.118.110.212 5152 (msg: "Storm worm phone home address 76.118.110.212\:5152"; sid: 1055202; rev: 1;)
alert tcp $HOME_NET any -> 76.118.46.91 7623 (msg: "Storm worm phone home address 76.118.46.91\:7623"; sid: 1055203; rev: 1;)
alert tcp $HOME_NET any -> 76.119.186.16 10908 (msg: "Storm worm phone home address 76.119.186.16\:10908"; sid: 1055204; rev: 1;)
alert tcp $HOME_NET any -> 76.124.114.13 6336 (msg: "Storm worm phone home address 76.124.114.13\:6336"; sid: 1055205; rev: 1;)
alert tcp $HOME_NET any -> 76.124.142.91 15360 (msg: "Storm worm phone home address 76.124.142.91\:15360"; sid: 1055206; rev: 1;)
alert tcp $HOME_NET any -> 76.125.159.234 2463 (msg: "Storm worm phone home address 76.125.159.234\:2463"; sid: 1055207; rev: 1;)
alert tcp $HOME_NET any -> 76.181.149.25 21111 (msg: "Storm worm phone home address 76.181.149.25\:21111"; sid: 1055208; rev: 1;)
alert tcp $HOME_NET any -> 76.221.233.29 16968 (msg: "Storm worm phone home address 76.221.233.29\:16968"; sid: 1055209; rev: 1;)
alert tcp $HOME_NET any -> 76.30.244.185 14768 (msg: "Storm worm phone home address 76.30.244.185\:14768"; sid: 1055210; rev: 1;)
alert tcp $HOME_NET any -> 76.79.102.251 19752 (msg: "Storm worm phone home address 76.79.102.251\:19752"; sid: 1055211; rev: 1;)
alert tcp $HOME_NET any -> 76.83.126.175 11204 (msg: "Storm worm phone home address 76.83.126.175\:11204"; sid: 1055212; rev: 1;)
alert tcp $HOME_NET any -> 76.93.55.87 31692 (msg: "Storm worm phone home address 76.93.55.87\:31692"; sid: 1055213; rev: 1;)
alert tcp $HOME_NET any -> 76.97.25.105 21390 (msg: "Storm worm phone home address 76.97.25.105\:21390"; sid: 1055214; rev: 1;)
alert tcp $HOME_NET any -> 77.104.233.90 16501 (msg: "Storm worm phone home address 77.104.233.90\:16501"; sid: 1055215; rev: 1;)
alert tcp $HOME_NET any -> 77.108.96.50 25181 (msg: "Storm worm phone home address 77.108.96.50\:25181"; sid: 1055216; rev: 1;)
alert tcp $HOME_NET any -> 77.108.97.135 5221 (msg: "Storm worm phone home address 77.108.97.135\:5221"; sid: 1055217; rev: 1;)
alert tcp $HOME_NET any -> 77.114.41.149 13361 (msg: "Storm worm phone home address 77.114.41.149\:13361"; sid: 1055218; rev: 1;)
alert tcp $HOME_NET any -> 77.123.130.212 4269 (msg: "Storm worm phone home address 77.123.130.212\:4269"; sid: 1055219; rev: 1;)
alert tcp $HOME_NET any -> 77.193.201.164 17972 (msg: "Storm worm phone home address 77.193.201.164\:17972"; sid: 1055220; rev: 1;)
alert tcp $HOME_NET any -> 77.197.77.37 13237 (msg: "Storm worm phone home address 77.197.77.37\:13237"; sid: 1055221; rev: 1;)
alert tcp $HOME_NET any -> 77.222.134.2 24671 (msg: "Storm worm phone home address 77.222.134.2\:24671"; sid: 1055222; rev: 1;)
alert tcp $HOME_NET any -> 77.233.176.205 8922 (msg: "Storm worm phone home address 77.233.176.205\:8922"; sid: 1055223; rev: 1;)
alert tcp $HOME_NET any -> 77.238.232.244 20232 (msg: "Storm worm phone home address 77.238.232.244\:20232"; sid: 1055224; rev: 1;)
alert tcp $HOME_NET any -> 77.239.239.167 9750 (msg: "Storm worm phone home address 77.239.239.167\:9750"; sid: 1055225; rev: 1;)
alert tcp $HOME_NET any -> 77.241.18.22 25915 (msg: "Storm worm phone home address 77.241.18.22\:25915"; sid: 1055226; rev: 1;)
alert tcp $HOME_NET any -> 77.243.99.103 8922 (msg: "Storm worm phone home address 77.243.99.103\:8922"; sid: 1055227; rev: 1;)
alert tcp $HOME_NET any -> 77.246.104.203 8103 (msg: "Storm worm phone home address 77.246.104.203\:8103"; sid: 1055228; rev: 1;)
alert tcp $HOME_NET any -> 77.247.169.41 2901 (msg: "Storm worm phone home address 77.247.169.41\:2901"; sid: 1055229; rev: 1;)
alert tcp $HOME_NET any -> 77.253.82.29 5714 (msg: "Storm worm phone home address 77.253.82.29\:5714"; sid: 1055230; rev: 1;)
alert tcp $HOME_NET any -> 77.254.63.86 30813 (msg: "Storm worm phone home address 77.254.63.86\:30813"; sid: 1055231; rev: 1;)
alert tcp $HOME_NET any -> 77.41.65.64 21433 (msg: "Storm worm phone home address 77.41.65.64\:21433"; sid: 1055232; rev: 1;)
alert tcp $HOME_NET any -> 77.49.131.75 24101 (msg: "Storm worm phone home address 77.49.131.75\:24101"; sid: 1055233; rev: 1;)
alert tcp $HOME_NET any -> 77.76.55.187 9124 (msg: "Storm worm phone home address 77.76.55.187\:9124"; sid: 1055234; rev: 1;)
alert tcp $HOME_NET any -> 77.78.8.217 15004 (msg: "Storm worm phone home address 77.78.8.217\:15004"; sid: 1055235; rev: 1;)
alert tcp $HOME_NET any -> 77.78.11.219 9544 (msg: "Storm worm phone home address 77.78.11.219\:9544"; sid: 1055236; rev: 1;)
alert tcp $HOME_NET any -> 78.106.119.122 31392 (msg: "Storm worm phone home address 78.106.119.122\:31392"; sid: 1055237; rev: 1;)
alert tcp $HOME_NET any -> 78.130.248.177 14009 (msg: "Storm worm phone home address 78.130.248.177\:14009"; sid: 1055238; rev: 1;)
alert tcp $HOME_NET any -> 78.163.3.179 32734 (msg: "Storm worm phone home address 78.163.3.179\:32734"; sid: 1055239; rev: 1;)
alert tcp $HOME_NET any -> 78.169.252.213 31027 (msg: "Storm worm phone home address 78.169.252.213\:31027"; sid: 1055240; rev: 1;)
alert tcp $HOME_NET any -> 78.171.96.66 27467 (msg: "Storm worm phone home address 78.171.96.66\:27467"; sid: 1055241; rev: 1;)
alert tcp $HOME_NET any -> 78.174.202.171 24628 (msg: "Storm worm phone home address 78.174.202.171\:24628"; sid: 1055242; rev: 1;)
alert tcp $HOME_NET any -> 78.176.101.203 32790 (msg: "Storm worm phone home address 78.176.101.203\:32790"; sid: 1055243; rev: 1;)
alert tcp $HOME_NET any -> 78.183.36.104 19031 (msg: "Storm worm phone home address 78.183.36.104\:19031"; sid: 1055244; rev: 1;)
alert tcp $HOME_NET any -> 78.184.247.226 32104 (msg: "Storm worm phone home address 78.184.247.226\:32104"; sid: 1055245; rev: 1;)
alert tcp $HOME_NET any -> 78.30.96.76 11161 (msg: "Storm worm phone home address 78.30.96.76\:11161"; sid: 1055246; rev: 1;)
alert tcp $HOME_NET any -> 78.37.187.103 14232 (msg: "Storm worm phone home address 78.37.187.103\:14232"; sid: 1055247; rev: 1;)
alert tcp $HOME_NET any -> 78.37.162.68 16595 (msg: "Storm worm phone home address 78.37.162.68\:16595"; sid: 1055248; rev: 1;)
alert tcp $HOME_NET any -> 78.62.27.142 20228 (msg: "Storm worm phone home address 78.62.27.142\:20228"; sid: 1055249; rev: 1;)
alert tcp $HOME_NET any -> 79.111.44.129 11757 (msg: "Storm worm phone home address 79.111.44.129\:11757"; sid: 1055250; rev: 1;)
alert tcp $HOME_NET any -> 79.112.10.187 7164 (msg: "Storm worm phone home address 79.112.10.187\:7164"; sid: 1055251; rev: 1;)
alert tcp $HOME_NET any -> 79.112.35.126 10968 (msg: "Storm worm phone home address 79.112.35.126\:10968"; sid: 1055252; rev: 1;)
alert tcp $HOME_NET any -> 79.113.78.215 24255 (msg: "Storm worm phone home address 79.113.78.215\:24255"; sid: 1055253; rev: 1;)
alert tcp $HOME_NET any -> 79.114.167.117 22831 (msg: "Storm worm phone home address 79.114.167.117\:22831"; sid: 1055254; rev: 1;)
alert tcp $HOME_NET any -> 79.115.5.231 25336 (msg: "Storm worm phone home address 79.115.5.231\:25336"; sid: 1055255; rev: 1;)
alert tcp $HOME_NET any -> 79.116.166.101 8858 (msg: "Storm worm phone home address 79.116.166.101\:8858"; sid: 1055256; rev: 1;)
alert tcp $HOME_NET any -> 79.116.5.89 10445 (msg: "Storm worm phone home address 79.116.5.89\:10445"; sid: 1055257; rev: 1;)
alert tcp $HOME_NET any -> 79.117.71.60 22964 (msg: "Storm worm phone home address 79.117.71.60\:22964"; sid: 1055258; rev: 1;)
alert tcp $HOME_NET any -> 79.117.81.179 11620 (msg: "Storm worm phone home address 79.117.81.179\:11620"; sid: 1055259; rev: 1;)
alert tcp $HOME_NET any -> 79.118.216.131 18954 (msg: "Storm worm phone home address 79.118.216.131\:18954"; sid: 1055260; rev: 1;)
alert tcp $HOME_NET any -> 79.119.35.59 28441 (msg: "Storm worm phone home address 79.119.35.59\:28441"; sid: 1055261; rev: 1;)
alert tcp $HOME_NET any -> 79.140.3.49 28986 (msg: "Storm worm phone home address 79.140.3.49\:28986"; sid: 1055262; rev: 1;)
alert tcp $HOME_NET any -> 79.145.208.133 27935 (msg: "Storm worm phone home address 79.145.208.133\:27935"; sid: 1055263; rev: 1;)
alert tcp $HOME_NET any -> 79.164.125.3 20262 (msg: "Storm worm phone home address 79.164.125.3\:20262"; sid: 1055264; rev: 1;)
alert tcp $HOME_NET any -> 79.165.164.221 28235 (msg: "Storm worm phone home address 79.165.164.221\:28235"; sid: 1055265; rev: 1;)
alert tcp $HOME_NET any -> 79.185.225.254 1674 (msg: "Storm worm phone home address 79.185.225.254\:1674"; sid: 1055266; rev: 1;)
alert tcp $HOME_NET any -> 79.186.60.158 1095 (msg: "Storm worm phone home address 79.186.60.158\:1095"; sid: 1055267; rev: 1;)
alert tcp $HOME_NET any -> 79.219.233.12 23753 (msg: "Storm worm phone home address 79.219.233.12\:23753"; sid: 1055268; rev: 1;)
alert tcp $HOME_NET any -> 79.37.211.249 22368 (msg: "Storm worm phone home address 79.37.211.249\:22368"; sid: 1055269; rev: 1;)
alert tcp $HOME_NET any -> 80.161.82.179 16891 (msg: "Storm worm phone home address 80.161.82.179\:16891"; sid: 1055270; rev: 1;)
alert tcp $HOME_NET any -> 80.196.238.175 1756 (msg: "Storm worm phone home address 80.196.238.175\:1756"; sid: 1055271; rev: 1;)
alert tcp $HOME_NET any -> 80.216.138.53 3085 (msg: "Storm worm phone home address 80.216.138.53\:3085"; sid: 1055272; rev: 1;)
alert tcp $HOME_NET any -> 80.246.242.82 26052 (msg: "Storm worm phone home address 80.246.242.82\:26052"; sid: 1055273; rev: 1;)
alert tcp $HOME_NET any -> 80.252.253.53 10908 (msg: "Storm worm phone home address 80.252.253.53\:10908"; sid: 1055274; rev: 1;)
alert tcp $HOME_NET any -> 80.252.150.247 21403 (msg: "Storm worm phone home address 80.252.150.247\:21403"; sid: 1055275; rev: 1;)
alert tcp $HOME_NET any -> 80.36.128.66 32897 (msg: "Storm worm phone home address 80.36.128.66\:32897"; sid: 1055276; rev: 1;)
alert tcp $HOME_NET any -> 80.55.255.162 6748 (msg: "Storm worm phone home address 80.55.255.162\:6748"; sid: 1055277; rev: 1;)
alert tcp $HOME_NET any -> 80.55.165.194 14751 (msg: "Storm worm phone home address 80.55.165.194\:14751"; sid: 1055278; rev: 1;)
alert tcp $HOME_NET any -> 80.57.147.35 7717 (msg: "Storm worm phone home address 80.57.147.35\:7717"; sid: 1055279; rev: 1;)
alert tcp $HOME_NET any -> 80.6.62.12 7164 (msg: "Storm worm phone home address 80.6.62.12\:7164"; sid: 1055280; rev: 1;)
alert tcp $HOME_NET any -> 80.76.61.202 3673 (msg: "Storm worm phone home address 80.76.61.202\:3673"; sid: 1055281; rev: 1;)
alert tcp $HOME_NET any -> 80.77.157.132 29050 (msg: "Storm worm phone home address 80.77.157.132\:29050"; sid: 1055282; rev: 1;)
alert tcp $HOME_NET any -> 80.80.173.67 15604 (msg: "Storm worm phone home address 80.80.173.67\:15604"; sid: 1055283; rev: 1;)
alert tcp $HOME_NET any -> 80.80.174.243 24594 (msg: "Storm worm phone home address 80.80.174.243\:24594"; sid: 1055284; rev: 1;)
alert tcp $HOME_NET any -> 80.87.145.10 16385 (msg: "Storm worm phone home address 80.87.145.10\:16385"; sid: 1055285; rev: 1;)
alert tcp $HOME_NET any -> 80.92.96.44 19782 (msg: "Storm worm phone home address 80.92.96.44\:19782"; sid: 1055286; rev: 1;)
alert tcp $HOME_NET any -> 80.92.96.66 32807 (msg: "Storm worm phone home address 80.92.96.66\:32807"; sid: 1055287; rev: 1;)
alert tcp $HOME_NET any -> 80.92.96.24 27918 (msg: "Storm worm phone home address 80.92.96.24\:27918"; sid: 1055288; rev: 1;)
alert tcp $HOME_NET any -> 80.92.96.50 7623 (msg: "Storm worm phone home address 80.92.96.50\:7623"; sid: 1055289; rev: 1;)
alert tcp $HOME_NET any -> 80.93.126.186 22921 (msg: "Storm worm phone home address 80.93.126.186\:22921"; sid: 1055290; rev: 1;)
alert tcp $HOME_NET any -> 80.93.122.2 16295 (msg: "Storm worm phone home address 80.93.122.2\:16295"; sid: 1055291; rev: 1;)
alert tcp $HOME_NET any -> 80.99.167.137 6349 (msg: "Storm worm phone home address 80.99.167.137\:6349"; sid: 1055292; rev: 1;)
alert tcp $HOME_NET any -> 81.141.144.72 10934 (msg: "Storm worm phone home address 81.141.144.72\:10934"; sid: 1055293; rev: 1;)
alert tcp $HOME_NET any -> 81.192.199.36 29616 (msg: "Storm worm phone home address 81.192.199.36\:29616"; sid: 1055294; rev: 1;)
alert tcp $HOME_NET any -> 81.192.181.208 20009 (msg: "Storm worm phone home address 81.192.181.208\:20009"; sid: 1055295; rev: 1;)
alert tcp $HOME_NET any -> 81.195.17.223 3081 (msg: "Storm worm phone home address 81.195.17.223\:3081"; sid: 1055296; rev: 1;)
alert tcp $HOME_NET any -> 81.200.48.126 27472 (msg: "Storm worm phone home address 81.200.48.126\:27472"; sid: 1055297; rev: 1;)
alert tcp $HOME_NET any -> 81.21.247.107 3986 (msg: "Storm worm phone home address 81.21.247.107\:3986"; sid: 1055298; rev: 1;)
alert tcp $HOME_NET any -> 81.222.208.214 28570 (msg: "Storm worm phone home address 81.222.208.214\:28570"; sid: 1055299; rev: 1;)
alert tcp $HOME_NET any -> 81.229.10.5 8798 (msg: "Storm worm phone home address 81.229.10.5\:8798"; sid: 1055300; rev: 1;)
alert tcp $HOME_NET any -> 81.229.10.5 19902 (msg: "Storm worm phone home address 81.229.10.5\:19902"; sid: 1055301; rev: 1;)
alert tcp $HOME_NET any -> 81.229.37.220 10921 (msg: "Storm worm phone home address 81.229.37.220\:10921"; sid: 1055302; rev: 1;)
alert tcp $HOME_NET any -> 81.246.192.171 3531 (msg: "Storm worm phone home address 81.246.192.171\:3531"; sid: 1055303; rev: 1;)
alert tcp $HOME_NET any -> 81.25.53.44 1198 (msg: "Storm worm phone home address 81.25.53.44\:1198"; sid: 1055304; rev: 1;)
alert tcp $HOME_NET any -> 81.25.53.50 16295 (msg: "Storm worm phone home address 81.25.53.50\:16295"; sid: 1055305; rev: 1;)
alert tcp $HOME_NET any -> 81.25.53.67 28557 (msg: "Storm worm phone home address 81.25.53.67\:28557"; sid: 1055306; rev: 1;)
alert tcp $HOME_NET any -> 81.25.53.106 21716 (msg: "Storm worm phone home address 81.25.53.106\:21716"; sid: 1055307; rev: 1;)
alert tcp $HOME_NET any -> 81.25.53.40 8712 (msg: "Storm worm phone home address 81.25.53.40\:8712"; sid: 1055308; rev: 1;)
alert tcp $HOME_NET any -> 81.251.228.138 27489 (msg: "Storm worm phone home address 81.251.228.138\:27489"; sid: 1055309; rev: 1;)
alert tcp $HOME_NET any -> 81.251.190.127 4376 (msg: "Storm worm phone home address 81.251.190.127\:4376"; sid: 1055310; rev: 1;)
alert tcp $HOME_NET any -> 81.36.198.200 2819 (msg: "Storm worm phone home address 81.36.198.200\:2819"; sid: 1055311; rev: 1;)
alert tcp $HOME_NET any -> 81.36.203.22 8845 (msg: "Storm worm phone home address 81.36.203.22\:8845"; sid: 1055312; rev: 1;)
alert tcp $HOME_NET any -> 81.58.48.242 12851 (msg: "Storm worm phone home address 81.58.48.242\:12851"; sid: 1055313; rev: 1;)
alert tcp $HOME_NET any -> 81.68.98.47 10891 (msg: "Storm worm phone home address 81.68.98.47\:10891"; sid: 1055314; rev: 1;)
alert tcp $HOME_NET any -> 81.84.52.166 6465 (msg: "Storm worm phone home address 81.84.52.166\:6465"; sid: 1055315; rev: 1;)
alert tcp $HOME_NET any -> 81.94.26.226 11693 (msg: "Storm worm phone home address 81.94.26.226\:11693"; sid: 1055316; rev: 1;)
alert tcp $HOME_NET any -> 82.114.65.102 25812 (msg: "Storm worm phone home address 82.114.65.102\:25812"; sid: 1055317; rev: 1;)
alert tcp $HOME_NET any -> 82.137.41.11 7704 (msg: "Storm worm phone home address 82.137.41.11\:7704"; sid: 1055318; rev: 1;)
alert tcp $HOME_NET any -> 82.139.13.231 27197 (msg: "Storm worm phone home address 82.139.13.231\:27197"; sid: 1055319; rev: 1;)
alert tcp $HOME_NET any -> 82.147.177.175 5607 (msg: "Storm worm phone home address 82.147.177.175\:5607"; sid: 1055320; rev: 1;)
alert tcp $HOME_NET any -> 82.150.169.36 6212 (msg: "Storm worm phone home address 82.150.169.36\:6212"; sid: 1055321; rev: 1;)
alert tcp $HOME_NET any -> 82.177.200.126 29286 (msg: "Storm worm phone home address 82.177.200.126\:29286"; sid: 1055322; rev: 1;)
alert tcp $HOME_NET any -> 82.199.195.208 13241 (msg: "Storm worm phone home address 82.199.195.208\:13241"; sid: 1055323; rev: 1;)
alert tcp $HOME_NET any -> 82.232.80.222 32567 (msg: "Storm worm phone home address 82.232.80.222\:32567"; sid: 1055324; rev: 1;)
alert tcp $HOME_NET any -> 82.235.48.140 19027 (msg: "Storm worm phone home address 82.235.48.140\:19027"; sid: 1055325; rev: 1;)
alert tcp $HOME_NET any -> 82.239.86.178 8729 (msg: "Storm worm phone home address 82.239.86.178\:8729"; sid: 1055326; rev: 1;)
alert tcp $HOME_NET any -> 82.240.27.39 26824 (msg: "Storm worm phone home address 82.240.27.39\:26824"; sid: 1055327; rev: 1;)
alert tcp $HOME_NET any -> 82.243.181.77 26417 (msg: "Storm worm phone home address 82.243.181.77\:26417"; sid: 1055328; rev: 1;)
alert tcp $HOME_NET any -> 82.247.64.102 6499 (msg: "Storm worm phone home address 82.247.64.102\:6499"; sid: 1055329; rev: 1;)
alert tcp $HOME_NET any -> 82.250.210.175 12255 (msg: "Storm worm phone home address 82.250.210.175\:12255"; sid: 1055330; rev: 1;)
alert tcp $HOME_NET any -> 82.251.184.58 7078 (msg: "Storm worm phone home address 82.251.184.58\:7078"; sid: 1055331; rev: 1;)
alert tcp $HOME_NET any -> 82.39.211.43 15150 (msg: "Storm worm phone home address 82.39.211.43\:15150"; sid: 1055332; rev: 1;)
alert tcp $HOME_NET any -> 82.66.248.78 15750 (msg: "Storm worm phone home address 82.66.248.78\:15750"; sid: 1055333; rev: 1;)
alert tcp $HOME_NET any -> 82.76.86.63 4299 (msg: "Storm worm phone home address 82.76.86.63\:4299"; sid: 1055334; rev: 1;)
alert tcp $HOME_NET any -> 82.77.182.91 25709 (msg: "Storm worm phone home address 82.77.182.91\:25709"; sid: 1055335; rev: 1;)
alert tcp $HOME_NET any -> 82.78.79.57 13327 (msg: "Storm worm phone home address 82.78.79.57\:13327"; sid: 1055336; rev: 1;)
alert tcp $HOME_NET any -> 82.79.160.131 29170 (msg: "Storm worm phone home address 82.79.160.131\:29170"; sid: 1055337; rev: 1;)
alert tcp $HOME_NET any -> 82.79.145.42 30813 (msg: "Storm worm phone home address 82.79.145.42\:30813"; sid: 1055338; rev: 1;)
alert tcp $HOME_NET any -> 83.110.104.253 17693 (msg: "Storm worm phone home address 83.110.104.253\:17693"; sid: 1055339; rev: 1;)
alert tcp $HOME_NET any -> 83.15.250.194 22857 (msg: "Storm worm phone home address 83.15.250.194\:22857"; sid: 1055340; rev: 1;)
alert tcp $HOME_NET any -> 83.152.46.14 25143 (msg: "Storm worm phone home address 83.152.46.14\:25143"; sid: 1055341; rev: 1;)
alert tcp $HOME_NET any -> 83.154.61.70 22698 (msg: "Storm worm phone home address 83.154.61.70\:22698"; sid: 1055342; rev: 1;)
alert tcp $HOME_NET any -> 83.17.62.242 33326 (msg: "Storm worm phone home address 83.17.62.242\:33326"; sid: 1055343; rev: 1;)
alert tcp $HOME_NET any -> 83.190.32.20 8468 (msg: "Storm worm phone home address 83.190.32.20\:8468"; sid: 1055344; rev: 1;)
alert tcp $HOME_NET any -> 83.194.192.47 19932 (msg: "Storm worm phone home address 83.194.192.47\:19932"; sid: 1055345; rev: 1;)
alert tcp $HOME_NET any -> 83.195.223.152 7477 (msg: "Storm worm phone home address 83.195.223.152\:7477"; sid: 1055346; rev: 1;)
alert tcp $HOME_NET any -> 83.196.173.9 9720 (msg: "Storm worm phone home address 83.196.173.9\:9720"; sid: 1055347; rev: 1;)
alert tcp $HOME_NET any -> 83.198.191.28 31044 (msg: "Storm worm phone home address 83.198.191.28\:31044"; sid: 1055348; rev: 1;)
alert tcp $HOME_NET any -> 83.200.169.166 28990 (msg: "Storm worm phone home address 83.200.169.166\:28990"; sid: 1055349; rev: 1;)
alert tcp $HOME_NET any -> 83.201.223.160 28205 (msg: "Storm worm phone home address 83.201.223.160\:28205"; sid: 1055350; rev: 1;)
alert tcp $HOME_NET any -> 83.22.2.50 8905 (msg: "Storm worm phone home address 83.22.2.50\:8905"; sid: 1055351; rev: 1;)
alert tcp $HOME_NET any -> 83.228.33.176 26704 (msg: "Storm worm phone home address 83.228.33.176\:26704"; sid: 1055352; rev: 1;)
alert tcp $HOME_NET any -> 83.23.244.64 6928 (msg: "Storm worm phone home address 83.23.244.64\:6928"; sid: 1055353; rev: 1;)
alert tcp $HOME_NET any -> 83.24.140.157 15360 (msg: "Storm worm phone home address 83.24.140.157\:15360"; sid: 1055354; rev: 1;)
alert tcp $HOME_NET any -> 83.27.69.210 31392 (msg: "Storm worm phone home address 83.27.69.210\:31392"; sid: 1055355; rev: 1;)
alert tcp $HOME_NET any -> 83.28.246.244 7777 (msg: "Storm worm phone home address 83.28.246.244\:7777"; sid: 1055356; rev: 1;)
alert tcp $HOME_NET any -> 83.29.181.109 31074 (msg: "Storm worm phone home address 83.29.181.109\:31074"; sid: 1055357; rev: 1;)
alert tcp $HOME_NET any -> 83.44.86.94 4415 (msg: "Storm worm phone home address 83.44.86.94\:4415"; sid: 1055358; rev: 1;)
alert tcp $HOME_NET any -> 83.5.14.186 13284 (msg: "Storm worm phone home address 83.5.14.186\:13284"; sid: 1055359; rev: 1;)
alert tcp $HOME_NET any -> 83.59.36.32 11281 (msg: "Storm worm phone home address 83.59.36.32\:11281"; sid: 1055360; rev: 1;)
alert tcp $HOME_NET any -> 83.6.55.58 1863 (msg: "Storm worm phone home address 83.6.55.58\:1863"; sid: 1055361; rev: 1;)
alert tcp $HOME_NET any -> 83.67.117.178 29020 (msg: "Storm worm phone home address 83.67.117.178\:29020"; sid: 1055362; rev: 1;)
alert tcp $HOME_NET any -> 83.7.14.45 14918 (msg: "Storm worm phone home address 83.7.14.45\:14918"; sid: 1055363; rev: 1;)
alert tcp $HOME_NET any -> 83.7.229.226 7430 (msg: "Storm worm phone home address 83.7.229.226\:7430"; sid: 1055364; rev: 1;)
alert tcp $HOME_NET any -> 83.9.69.81 30058 (msg: "Storm worm phone home address 83.9.69.81\:30058"; sid: 1055365; rev: 1;)
alert tcp $HOME_NET any -> 83.9.206.2 13357 (msg: "Storm worm phone home address 83.9.206.2\:13357"; sid: 1055366; rev: 1;)
alert tcp $HOME_NET any -> 84.102.25.32 22801 (msg: "Storm worm phone home address 84.102.25.32\:22801"; sid: 1055367; rev: 1;)
alert tcp $HOME_NET any -> 84.110.204.73 17766 (msg: "Storm worm phone home address 84.110.204.73\:17766"; sid: 1055368; rev: 1;)
alert tcp $HOME_NET any -> 84.15.135.165 7258 (msg: "Storm worm phone home address 84.15.135.165\:7258"; sid: 1055369; rev: 1;)
alert tcp $HOME_NET any -> 84.173.76.248 33442 (msg: "Storm worm phone home address 84.173.76.248\:33442"; sid: 1055370; rev: 1;)
alert tcp $HOME_NET any -> 84.181.246.203 22402 (msg: "Storm worm phone home address 84.181.246.203\:22402"; sid: 1055371; rev: 1;)
alert tcp $HOME_NET any -> 84.193.68.48 9939 (msg: "Storm worm phone home address 84.193.68.48\:9939"; sid: 1055372; rev: 1;)
alert tcp $HOME_NET any -> 84.197.126.50 13357 (msg: "Storm worm phone home address 84.197.126.50\:13357"; sid: 1055373; rev: 1;)
alert tcp $HOME_NET any -> 84.198.211.65 5397 (msg: "Storm worm phone home address 84.198.211.65\:5397"; sid: 1055374; rev: 1;)
alert tcp $HOME_NET any -> 84.205.170.161 25143 (msg: "Storm worm phone home address 84.205.170.161\:25143"; sid: 1055375; rev: 1;)
alert tcp $HOME_NET any -> 84.208.241.101 9750 (msg: "Storm worm phone home address 84.208.241.101\:9750"; sid: 1055376; rev: 1;)
alert tcp $HOME_NET any -> 84.228.115.233 7237 (msg: "Storm worm phone home address 84.228.115.233\:7237"; sid: 1055377; rev: 1;)
alert tcp $HOME_NET any -> 84.242.204.252 7747 (msg: "Storm worm phone home address 84.242.204.252\:7747"; sid: 1055378; rev: 1;)
alert tcp $HOME_NET any -> 84.32.94.50 18053 (msg: "Storm worm phone home address 84.32.94.50\:18053"; sid: 1055379; rev: 1;)
alert tcp $HOME_NET any -> 84.32.96.15 5397 (msg: "Storm worm phone home address 84.32.96.15\:5397"; sid: 1055380; rev: 1;)
alert tcp $HOME_NET any -> 84.32.103.72 23303 (msg: "Storm worm phone home address 84.32.103.72\:23303"; sid: 1055381; rev: 1;)
alert tcp $HOME_NET any -> 84.32.94.59 20485 (msg: "Storm worm phone home address 84.32.94.59\:20485"; sid: 1055382; rev: 1;)
alert tcp $HOME_NET any -> 84.39.1.31 33442 (msg: "Storm worm phone home address 84.39.1.31\:33442"; sid: 1055383; rev: 1;)
alert tcp $HOME_NET any -> 84.47.161.242 16398 (msg: "Storm worm phone home address 84.47.161.242\:16398"; sid: 1055384; rev: 1;)
alert tcp $HOME_NET any -> 84.52.73.162 6769 (msg: "Storm worm phone home address 84.52.73.162\:6769"; sid: 1055385; rev: 1;)
alert tcp $HOME_NET any -> 84.55.92.135 16119 (msg: "Storm worm phone home address 84.55.92.135\:16119"; sid: 1055386; rev: 1;)
alert tcp $HOME_NET any -> 84.68.165.64 18594 (msg: "Storm worm phone home address 84.68.165.64\:18594"; sid: 1055387; rev: 1;)
alert tcp $HOME_NET any -> 85.100.228.209 2626 (msg: "Storm worm phone home address 85.100.228.209\:2626"; sid: 1055388; rev: 1;)
alert tcp $HOME_NET any -> 85.101.247.218 7164 (msg: "Storm worm phone home address 85.101.247.218\:7164"; sid: 1055389; rev: 1;)
alert tcp $HOME_NET any -> 85.106.187.24 7327 (msg: "Storm worm phone home address 85.106.187.24\:7327"; sid: 1055390; rev: 1;)
alert tcp $HOME_NET any -> 85.107.139.24 32318 (msg: "Storm worm phone home address 85.107.139.24\:32318"; sid: 1055391; rev: 1;)
alert tcp $HOME_NET any -> 85.107.254.50 31739 (msg: "Storm worm phone home address 85.107.254.50\:31739"; sid: 1055392; rev: 1;)
alert tcp $HOME_NET any -> 85.110.133.35 31713 (msg: "Storm worm phone home address 85.110.133.35\:31713"; sid: 1055393; rev: 1;)
alert tcp $HOME_NET any -> 85.121.62.163 14609 (msg: "Storm worm phone home address 85.121.62.163\:14609"; sid: 1055394; rev: 1;)
alert tcp $HOME_NET any -> 85.13.78.200 27725 (msg: "Storm worm phone home address 85.13.78.200\:27725"; sid: 1055395; rev: 1;)
alert tcp $HOME_NET any -> 85.140.54.80 11401 (msg: "Storm worm phone home address 85.140.54.80\:11401"; sid: 1055396; rev: 1;)
alert tcp $HOME_NET any -> 85.146.161.254 2819 (msg: "Storm worm phone home address 85.146.161.254\:2819"; sid: 1055397; rev: 1;)
alert tcp $HOME_NET any -> 85.160.80.91 24023 (msg: "Storm worm phone home address 85.160.80.91\:24023"; sid: 1055398; rev: 1;)
alert tcp $HOME_NET any -> 85.160.77.158 24272 (msg: "Storm worm phone home address 85.160.77.158\:24272"; sid: 1055399; rev: 1;)
alert tcp $HOME_NET any -> 85.196.152.229 30311 (msg: "Storm worm phone home address 85.196.152.229\:30311"; sid: 1055400; rev: 1;)
alert tcp $HOME_NET any -> 85.204.213.91 27961 (msg: "Storm worm phone home address 85.204.213.91\:27961"; sid: 1055401; rev: 1;)
alert tcp $HOME_NET any -> 85.219.242.26 17097 (msg: "Storm worm phone home address 85.219.242.26\:17097"; sid: 1055402; rev: 1;)
alert tcp $HOME_NET any -> 85.236.10.222 22115 (msg: "Storm worm phone home address 85.236.10.222\:22115"; sid: 1055403; rev: 1;)
alert tcp $HOME_NET any -> 85.237.226.41 2969 (msg: "Storm worm phone home address 85.237.226.41\:2969"; sid: 1055404; rev: 1;)
alert tcp $HOME_NET any -> 85.30.198.105 33442 (msg: "Storm worm phone home address 85.30.198.105\:33442"; sid: 1055405; rev: 1;)
alert tcp $HOME_NET any -> 85.73.77.89 1756 (msg: "Storm worm phone home address 85.73.77.89\:1756"; sid: 1055406; rev: 1;)
alert tcp $HOME_NET any -> 85.74.57.93 24152 (msg: "Storm worm phone home address 85.74.57.93\:24152"; sid: 1055407; rev: 1;)
alert tcp $HOME_NET any -> 85.91.141.147 16265 (msg: "Storm worm phone home address 85.91.141.147\:16265"; sid: 1055408; rev: 1;)
alert tcp $HOME_NET any -> 85.93.137.152 9900 (msg: "Storm worm phone home address 85.93.137.152\:9900"; sid: 1055409; rev: 1;)
alert tcp $HOME_NET any -> 85.96.154.250 28840 (msg: "Storm worm phone home address 85.96.154.250\:28840"; sid: 1055410; rev: 1;)
alert tcp $HOME_NET any -> 85.97.32.71 10080 (msg: "Storm worm phone home address 85.97.32.71\:10080"; sid: 1055411; rev: 1;)
alert tcp $HOME_NET any -> 86.106.45.35 16338 (msg: "Storm worm phone home address 86.106.45.35\:16338"; sid: 1055412; rev: 1;)
alert tcp $HOME_NET any -> 86.106.56.148 26142 (msg: "Storm worm phone home address 86.106.56.148\:26142"; sid: 1055413; rev: 1;)
alert tcp $HOME_NET any -> 86.121.241.13 32262 (msg: "Storm worm phone home address 86.121.241.13\:32262"; sid: 1055414; rev: 1;)
alert tcp $HOME_NET any -> 86.122.36.76 4861 (msg: "Storm worm phone home address 86.122.36.76\:4861"; sid: 1055415; rev: 1;)
alert tcp $HOME_NET any -> 86.122.38.220 29020 (msg: "Storm worm phone home address 86.122.38.220\:29020"; sid: 1055416; rev: 1;)
alert tcp $HOME_NET any -> 86.209.54.178 5084 (msg: "Storm worm phone home address 86.209.54.178\:5084"; sid: 1055417; rev: 1;)
alert tcp $HOME_NET any -> 86.69.133.225 13563 (msg: "Storm worm phone home address 86.69.133.225\:13563"; sid: 1055418; rev: 1;)
alert tcp $HOME_NET any -> 86.70.143.240 1511 (msg: "Storm worm phone home address 86.70.143.240\:1511"; sid: 1055419; rev: 1;)
alert tcp $HOME_NET any -> 86.98.85.117 1554 (msg: "Storm worm phone home address 86.98.85.117\:1554"; sid: 1055420; rev: 1;)
alert tcp $HOME_NET any -> 87.102.121.151 19940 (msg: "Storm worm phone home address 87.102.121.151\:19940"; sid: 1055421; rev: 1;)
alert tcp $HOME_NET any -> 87.13.214.20 6748 (msg: "Storm worm phone home address 87.13.214.20\:6748"; sid: 1055422; rev: 1;)
alert tcp $HOME_NET any -> 87.206.58.93 33382 (msg: "Storm worm phone home address 87.206.58.93\:33382"; sid: 1055423; rev: 1;)
alert tcp $HOME_NET any -> 87.228.59.71 10136 (msg: "Storm worm phone home address 87.228.59.71\:10136"; sid: 1055424; rev: 1;)
alert tcp $HOME_NET any -> 87.236.29.87 23629 (msg: "Storm worm phone home address 87.236.29.87\:23629"; sid: 1055425; rev: 1;)
alert tcp $HOME_NET any -> 87.237.118.17 15257 (msg: "Storm worm phone home address 87.237.118.17\:15257"; sid: 1055426; rev: 1;)
alert tcp $HOME_NET any -> 87.240.15.8 27566 (msg: "Storm worm phone home address 87.240.15.8\:27566"; sid: 1055427; rev: 1;)
alert tcp $HOME_NET any -> 87.244.200.66 6705 (msg: "Storm worm phone home address 87.244.200.66\:6705"; sid: 1055428; rev: 1;)
alert tcp $HOME_NET any -> 87.97.124.40 4127 (msg: "Storm worm phone home address 87.97.124.40\:4127"; sid: 1055429; rev: 1;)
alert tcp $HOME_NET any -> 88.0.219.49 10934 (msg: "Storm worm phone home address 88.0.219.49\:10934"; sid: 1055430; rev: 1;)
alert tcp $HOME_NET any -> 88.119.246.56 19932 (msg: "Storm worm phone home address 88.119.246.56\:19932"; sid: 1055431; rev: 1;)
alert tcp $HOME_NET any -> 88.158.215.54 22492 (msg: "Storm worm phone home address 88.158.215.54\:22492"; sid: 1055432; rev: 1;)
alert tcp $HOME_NET any -> 88.158.159.153 9754 (msg: "Storm worm phone home address 88.158.159.153\:9754"; sid: 1055433; rev: 1;)
alert tcp $HOME_NET any -> 88.199.133.254 4972 (msg: "Storm worm phone home address 88.199.133.254\:4972"; sid: 1055434; rev: 1;)
alert tcp $HOME_NET any -> 88.214.66.172 23303 (msg: "Storm worm phone home address 88.214.66.172\:23303"; sid: 1055435; rev: 1;)
alert tcp $HOME_NET any -> 88.216.35.8 25829 (msg: "Storm worm phone home address 88.216.35.8\:25829"; sid: 1055436; rev: 1;)
alert tcp $HOME_NET any -> 88.216.47.49 14575 (msg: "Storm worm phone home address 88.216.47.49\:14575"; sid: 1055437; rev: 1;)
alert tcp $HOME_NET any -> 88.224.10.119 3853 (msg: "Storm worm phone home address 88.224.10.119\:3853"; sid: 1055438; rev: 1;)
alert tcp $HOME_NET any -> 88.224.96.230 32357 (msg: "Storm worm phone home address 88.224.96.230\:32357"; sid: 1055439; rev: 1;)
alert tcp $HOME_NET any -> 88.229.252.250 1554 (msg: "Storm worm phone home address 88.229.252.250\:1554"; sid: 1055440; rev: 1;)
alert tcp $HOME_NET any -> 88.229.158.182 1756 (msg: "Storm worm phone home address 88.229.158.182\:1756"; sid: 1055441; rev: 1;)
alert tcp $HOME_NET any -> 88.230.150.2 7996 (msg: "Storm worm phone home address 88.230.150.2\:7996"; sid: 1055442; rev: 1;)
alert tcp $HOME_NET any -> 88.230.108.187 10166 (msg: "Storm worm phone home address 88.230.108.187\:10166"; sid: 1055443; rev: 1;)
alert tcp $HOME_NET any -> 88.238.207.93 4046 (msg: "Storm worm phone home address 88.238.207.93\:4046"; sid: 1055444; rev: 1;)
alert tcp $HOME_NET any -> 88.240.167.218 13224 (msg: "Storm worm phone home address 88.240.167.218\:13224"; sid: 1055445; rev: 1;)
alert tcp $HOME_NET any -> 88.240.154.207 4951 (msg: "Storm worm phone home address 88.240.154.207\:4951"; sid: 1055446; rev: 1;)
alert tcp $HOME_NET any -> 88.242.169.232 8811 (msg: "Storm worm phone home address 88.242.169.232\:8811"; sid: 1055447; rev: 1;)
alert tcp $HOME_NET any -> 88.244.8.160 4110 (msg: "Storm worm phone home address 88.244.8.160\:4110"; sid: 1055448; rev: 1;)
alert tcp $HOME_NET any -> 88.249.20.247 24847 (msg: "Storm worm phone home address 88.249.20.247\:24847"; sid: 1055449; rev: 1;)
alert tcp $HOME_NET any -> 88.250.74.179 26151 (msg: "Storm worm phone home address 88.250.74.179\:26151"; sid: 1055450; rev: 1;)
alert tcp $HOME_NET any -> 88.251.40.225 26159 (msg: "Storm worm phone home address 88.251.40.225\:26159"; sid: 1055451; rev: 1;)
alert tcp $HOME_NET any -> 88.252.40.147 2236 (msg: "Storm worm phone home address 88.252.40.147\:2236"; sid: 1055452; rev: 1;)
alert tcp $HOME_NET any -> 88.254.48.210 1777 (msg: "Storm worm phone home address 88.254.48.210\:1777"; sid: 1055453; rev: 1;)
alert tcp $HOME_NET any -> 88.254.184.217 30843 (msg: "Storm worm phone home address 88.254.184.217\:30843"; sid: 1055454; rev: 1;)
alert tcp $HOME_NET any -> 88.70.159.30 14897 (msg: "Storm worm phone home address 88.70.159.30\:14897"; sid: 1055455; rev: 1;)
alert tcp $HOME_NET any -> 88.70.248.87 10848 (msg: "Storm worm phone home address 88.70.248.87\:10848"; sid: 1055456; rev: 1;)
alert tcp $HOME_NET any -> 89.100.67.138 6156 (msg: "Storm worm phone home address 89.100.67.138\:6156"; sid: 1055457; rev: 1;)
alert tcp $HOME_NET any -> 89.109.44.95 11161 (msg: "Storm worm phone home address 89.109.44.95\:11161"; sid: 1055458; rev: 1;)
alert tcp $HOME_NET any -> 89.109.224.79 17693 (msg: "Storm worm phone home address 89.109.224.79\:17693"; sid: 1055459; rev: 1;)
alert tcp $HOME_NET any -> 89.112.8.182 25014 (msg: "Storm worm phone home address 89.112.8.182\:25014"; sid: 1055460; rev: 1;)
alert tcp $HOME_NET any -> 89.113.75.101 30551 (msg: "Storm worm phone home address 89.113.75.101\:30551"; sid: 1055461; rev: 1;)
alert tcp $HOME_NET any -> 89.113.79.37 9566 (msg: "Storm worm phone home address 89.113.79.37\:9566"; sid: 1055462; rev: 1;)
alert tcp $HOME_NET any -> 89.123.15.196 28059 (msg: "Storm worm phone home address 89.123.15.196\:28059"; sid: 1055463; rev: 1;)
alert tcp $HOME_NET any -> 89.133.144.87 10522 (msg: "Storm worm phone home address 89.133.144.87\:10522"; sid: 1055464; rev: 1;)
alert tcp $HOME_NET any -> 89.133.117.4 21497 (msg: "Storm worm phone home address 89.133.117.4\:21497"; sid: 1055465; rev: 1;)
alert tcp $HOME_NET any -> 89.142.179.115 16385 (msg: "Storm worm phone home address 89.142.179.115\:16385"; sid: 1055466; rev: 1;)
alert tcp $HOME_NET any -> 89.149.92.210 24714 (msg: "Storm worm phone home address 89.149.92.210\:24714"; sid: 1055467; rev: 1;)
alert tcp $HOME_NET any -> 89.162.150.195 5084 (msg: "Storm worm phone home address 89.162.150.195\:5084"; sid: 1055468; rev: 1;)
alert tcp $HOME_NET any -> 89.170.68.98 24388 (msg: "Storm worm phone home address 89.170.68.98\:24388"; sid: 1055469; rev: 1;)
alert tcp $HOME_NET any -> 89.171.42.7 9566 (msg: "Storm worm phone home address 89.171.42.7\:9566"; sid: 1055470; rev: 1;)
alert tcp $HOME_NET any -> 89.174.63.1 32657 (msg: "Storm worm phone home address 89.174.63.1\:32657"; sid: 1055471; rev: 1;)
alert tcp $HOME_NET any -> 89.178.180.189 12842 (msg: "Storm worm phone home address 89.178.180.189\:12842"; sid: 1055472; rev: 1;)
alert tcp $HOME_NET any -> 89.212.25.76 24688 (msg: "Storm worm phone home address 89.212.25.76\:24688"; sid: 1055473; rev: 1;)
alert tcp $HOME_NET any -> 89.212.116.117 14532 (msg: "Storm worm phone home address 89.212.116.117\:14532"; sid: 1055474; rev: 1;)
alert tcp $HOME_NET any -> 89.212.52.59 29140 (msg: "Storm worm phone home address 89.212.52.59\:29140"; sid: 1055475; rev: 1;)
alert tcp $HOME_NET any -> 89.215.38.36 15244 (msg: "Storm worm phone home address 89.215.38.36\:15244"; sid: 1055476; rev: 1;)
alert tcp $HOME_NET any -> 89.222.164.150 8798 (msg: "Storm worm phone home address 89.222.164.150\:8798"; sid: 1055477; rev: 1;)
alert tcp $HOME_NET any -> 89.223.25.193 32318 (msg: "Storm worm phone home address 89.223.25.193\:32318"; sid: 1055478; rev: 1;)
alert tcp $HOME_NET any -> 89.226.163.143 33502 (msg: "Storm worm phone home address 89.226.163.143\:33502"; sid: 1055479; rev: 1;)
alert tcp $HOME_NET any -> 89.25.82.153 6902 (msg: "Storm worm phone home address 89.25.82.153\:6902"; sid: 1055480; rev: 1;)
alert tcp $HOME_NET any -> 89.25.111.152 7880 (msg: "Storm worm phone home address 89.25.111.152\:7880"; sid: 1055481; rev: 1;)
alert tcp $HOME_NET any -> 89.39.80.8 5178 (msg: "Storm worm phone home address 89.39.80.8\:5178"; sid: 1055482; rev: 1;)
alert tcp $HOME_NET any -> 89.76.193.150 11680 (msg: "Storm worm phone home address 89.76.193.150\:11680"; sid: 1055483; rev: 1;)
alert tcp $HOME_NET any -> 89.83.93.144 4063 (msg: "Storm worm phone home address 89.83.93.144\:4063"; sid: 1055484; rev: 1;)
alert tcp $HOME_NET any -> 90.154.211.34 33549 (msg: "Storm worm phone home address 90.154.211.34\:33549"; sid: 1055485; rev: 1;)
alert tcp $HOME_NET any -> 90.183.248.253 1301 (msg: "Storm worm phone home address 90.183.248.253\:1301"; sid: 1055486; rev: 1;)
alert tcp $HOME_NET any -> 90.193.27.175 33742 (msg: "Storm worm phone home address 90.193.27.175\:33742"; sid: 1055487; rev: 1;)
alert tcp $HOME_NET any -> 90.206.92.156 16072 (msg: "Storm worm phone home address 90.206.92.156\:16072"; sid: 1055488; rev: 1;)
alert tcp $HOME_NET any -> 90.22.133.10 16578 (msg: "Storm worm phone home address 90.22.133.10\:16578"; sid: 1055489; rev: 1;)
alert tcp $HOME_NET any -> 90.22.207.129 8811 (msg: "Storm worm phone home address 90.22.207.129\:8811"; sid: 1055490; rev: 1;)
alert tcp $HOME_NET any -> 90.242.59.43 8755 (msg: "Storm worm phone home address 90.242.59.43\:8755"; sid: 1055491; rev: 1;)
alert tcp $HOME_NET any -> 90.25.18.187 17011 (msg: "Storm worm phone home address 90.25.18.187\:17011"; sid: 1055492; rev: 1;)
alert tcp $HOME_NET any -> 90.47.142.235 25203 (msg: "Storm worm phone home address 90.47.142.235\:25203"; sid: 1055493; rev: 1;)
alert tcp $HOME_NET any -> 90.52.136.253 12649 (msg: "Storm worm phone home address 90.52.136.253\:12649"; sid: 1055494; rev: 1;)
alert tcp $HOME_NET any -> 91.103.207.30 27566 (msg: "Storm worm phone home address 91.103.207.30\:27566"; sid: 1055495; rev: 1;)
alert tcp $HOME_NET any -> 91.122.63.115 28441 (msg: "Storm worm phone home address 91.122.63.115\:28441"; sid: 1055496; rev: 1;)
alert tcp $HOME_NET any -> 91.123.218.191 4685 (msg: "Storm worm phone home address 91.123.218.191\:4685"; sid: 1055497; rev: 1;)
alert tcp $HOME_NET any -> 91.124.208.190 21716 (msg: "Storm worm phone home address 91.124.208.190\:21716"; sid: 1055498; rev: 1;)
alert tcp $HOME_NET any -> 91.139.254.250 21789 (msg: "Storm worm phone home address 91.139.254.250\:21789"; sid: 1055499; rev: 1;)
alert tcp $HOME_NET any -> 91.140.94.238 22248 (msg: "Storm worm phone home address 91.140.94.238\:22248"; sid: 1055500; rev: 1;)
alert tcp $HOME_NET any -> 91.164.56.97 32404 (msg: "Storm worm phone home address 91.164.56.97\:32404"; sid: 1055501; rev: 1;)
alert tcp $HOME_NET any -> 91.187.123.66 9124 (msg: "Storm worm phone home address 91.187.123.66\:9124"; sid: 1055502; rev: 1;)
alert tcp $HOME_NET any -> 91.192.32.115 16874 (msg: "Storm worm phone home address 91.192.32.115\:16874"; sid: 1055503; rev: 1;)
alert tcp $HOME_NET any -> 91.196.153.216 9034 (msg: "Storm worm phone home address 91.196.153.216\:9034"; sid: 1055504; rev: 1;)
alert tcp $HOME_NET any -> 91.196.215.11 18229 (msg: "Storm worm phone home address 91.196.215.11\:18229"; sid: 1055505; rev: 1;)
alert tcp $HOME_NET any -> 91.76.42.186 4299 (msg: "Storm worm phone home address 91.76.42.186\:4299"; sid: 1055506; rev: 1;)
alert tcp $HOME_NET any -> 91.76.24.108 8751 (msg: "Storm worm phone home address 91.76.24.108\:8751"; sid: 1055507; rev: 1;)
alert tcp $HOME_NET any -> 91.76.26.179 25846 (msg: "Storm worm phone home address 91.76.26.179\:25846"; sid: 1055508; rev: 1;)
alert tcp $HOME_NET any -> 91.78.49.27 25203 (msg: "Storm worm phone home address 91.78.49.27\:25203"; sid: 1055509; rev: 1;)
alert tcp $HOME_NET any -> 91.90.225.55 9956 (msg: "Storm worm phone home address 91.90.225.55\:9956"; sid: 1055510; rev: 1;)
alert tcp $HOME_NET any -> 92.113.205.180 25014 (msg: "Storm worm phone home address 92.113.205.180\:25014"; sid: 1055511; rev: 1;)
alert tcp $HOME_NET any -> 92.192.90.150 19070 (msg: "Storm worm phone home address 92.192.90.150\:19070"; sid: 1055512; rev: 1;)
alert tcp $HOME_NET any -> 92.226.202.117 20837 (msg: "Storm worm phone home address 92.226.202.117\:20837"; sid: 1055513; rev: 1;)
alert tcp $HOME_NET any -> 92.53.33.202 7078 (msg: "Storm worm phone home address 92.53.33.202\:7078"; sid: 1055514; rev: 1;)
alert tcp $HOME_NET any -> 92.80.145.196 3870 (msg: "Storm worm phone home address 92.80.145.196\:3870"; sid: 1055515; rev: 1;)
alert tcp $HOME_NET any -> 96.234.43.229 32344 (msg: "Storm worm phone home address 96.234.43.229\:32344"; sid: 1055516; rev: 1;)
alert tcp $HOME_NET any -> 96.235.17.33 9566 (msg: "Storm worm phone home address 96.235.17.33\:9566"; sid: 1055517; rev: 1;)
alert tcp $HOME_NET any -> 96.240.63.66 25126 (msg: "Storm worm phone home address 96.240.63.66\:25126"; sid: 1055518; rev: 1;)
alert tcp $HOME_NET any -> 96.252.197.72 11217 (msg: "Storm worm phone home address 96.252.197.72\:11217"; sid: 1055519; rev: 1;)
alert tcp $HOME_NET any -> 98.195.207.35 18817 (msg: "Storm worm phone home address 98.195.207.35\:18817"; sid: 1055520; rev: 1;)
alert tcp $HOME_NET any -> 98.196.50.150 1357 (msg: "Storm worm phone home address 98.196.50.150\:1357"; sid: 1055521; rev: 1;)
alert tcp $HOME_NET any -> 98.199.176.102 29140 (msg: "Storm worm phone home address 98.199.176.102\:29140"; sid: 1055522; rev: 1;)
alert tcp $HOME_NET any -> 98.206.121.72 19589 (msg: "Storm worm phone home address 98.206.121.72\:19589"; sid: 1055523; rev: 1;)
alert tcp $HOME_NET any -> 98.207.10.53 4127 (msg: "Storm worm phone home address 98.207.10.53\:4127"; sid: 1055524; rev: 1;)
alert tcp $HOME_NET any -> 98.215.127.148 18169 (msg: "Storm worm phone home address 98.215.127.148\:18169"; sid: 1055525; rev: 1;)
alert tcp $HOME_NET any -> 98.222.159.109 9038 (msg: "Storm worm phone home address 98.222.159.109\:9038"; sid: 1055526; rev: 1;)
alert tcp $HOME_NET any -> 98.227.90.244 6396 (msg: "Storm worm phone home address 98.227.90.244\:6396"; sid: 1055527; rev: 1;)
alert tcp $HOME_NET any -> 99.129.31.172 22724 (msg: "Storm worm phone home address 99.129.31.172\:22724"; sid: 1055528; rev: 1;)
alert tcp $HOME_NET any -> 99.241.33.205 4063 (msg: "Storm worm phone home address 99.241.33.205\:4063"; sid: 1055529; rev: 1;)
alert tcp $HOME_NET any -> 99.243.121.154 22780 (msg: "Storm worm phone home address 99.243.121.154\:22780"; sid: 1055530; rev: 1;)
alert tcp $HOME_NET any -> 116.122.189.227 8223 (msg: "Storm worm phone home address 116.122.189.227\:8223"; sid: 1055531; rev: 1;)
alert tcp $HOME_NET any -> 118.7.205.93 1155 (msg: "Storm worm phone home address 118.7.205.93\:1155"; sid: 1055532; rev: 1;)
alert tcp $HOME_NET any -> 121.139.230.244 20511 (msg: "Storm worm phone home address 121.139.230.244\:20511"; sid: 1055533; rev: 1;)
alert tcp $HOME_NET any -> 121.31.49.191 10342 (msg: "Storm worm phone home address 121.31.49.191\:10342"; sid: 1055534; rev: 1;)
alert tcp $HOME_NET any -> 121.54.96.20 18941 (msg: "Storm worm phone home address 121.54.96.20\:18941"; sid: 1055535; rev: 1;)
alert tcp $HOME_NET any -> 121.55.238.134 6842 (msg: "Storm worm phone home address 121.55.238.134\:6842"; sid: 1055536; rev: 1;)
alert tcp $HOME_NET any -> 121.82.237.68 24062 (msg: "Storm worm phone home address 121.82.237.68\:24062"; sid: 1055537; rev: 1;)
alert tcp $HOME_NET any -> 122.163.103.6 19061 (msg: "Storm worm phone home address 122.163.103.6\:19061"; sid: 1055538; rev: 1;)
alert tcp $HOME_NET any -> 122.169.19.90 12272 (msg: "Storm worm phone home address 122.169.19.90\:12272"; sid: 1055539; rev: 1;)
alert tcp $HOME_NET any -> 122.31.88.173 8884 (msg: "Storm worm phone home address 122.31.88.173\:8884"; sid: 1055540; rev: 1;)
alert tcp $HOME_NET any -> 123.201.8.117 17890 (msg: "Storm worm phone home address 123.201.8.117\:17890"; sid: 1055541; rev: 1;)
alert tcp $HOME_NET any -> 123.236.115.115 24864 (msg: "Storm worm phone home address 123.236.115.115\:24864"; sid: 1055542; rev: 1;)
alert tcp $HOME_NET any -> 124.216.87.21 16788 (msg: "Storm worm phone home address 124.216.87.21\:16788"; sid: 1055543; rev: 1;)
alert tcp $HOME_NET any -> 124.216.87.21 29749 (msg: "Storm worm phone home address 124.216.87.21\:29749"; sid: 1055544; rev: 1;)
alert tcp $HOME_NET any -> 125.128.27.48 12559 (msg: "Storm worm phone home address 125.128.27.48\:12559"; sid: 1055545; rev: 1;)
alert tcp $HOME_NET any -> 125.233.86.109 14425 (msg: "Storm worm phone home address 125.233.86.109\:14425"; sid: 1055546; rev: 1;)
alert tcp $HOME_NET any -> 132.239.1.114 52371 (msg: "Storm worm phone home address 132.239.1.114\:52371"; sid: 1055547; rev: 1;)
alert tcp $HOME_NET any -> 134.147.63.77 10080 (msg: "Storm worm phone home address 134.147.63.77\:10080"; sid: 1055548; rev: 1;)
alert tcp $HOME_NET any -> 144.131.145.91 17453 (msg: "Storm worm phone home address 144.131.145.91\:17453"; sid: 1055549; rev: 1;)
alert tcp $HOME_NET any -> 147.83.175.67 21433 (msg: "Storm worm phone home address 147.83.175.67\:21433"; sid: 1055550; rev: 1;)
alert tcp $HOME_NET any -> 148.160.184.109 10535 (msg: "Storm worm phone home address 148.160.184.109\:10535"; sid: 1055551; rev: 1;)
alert tcp $HOME_NET any -> 150.101.100.80 22990 (msg: "Storm worm phone home address 150.101.100.80\:22990"; sid: 1055552; rev: 1;)
alert tcp $HOME_NET any -> 157.100.153.2 26567 (msg: "Storm worm phone home address 157.100.153.2\:26567"; sid: 1055553; rev: 1;)
alert tcp $HOME_NET any -> 159.39.51.181 12418 (msg: "Storm worm phone home address 159.39.51.181\:12418"; sid: 1055554; rev: 1;)
alert tcp $HOME_NET any -> 159.83.130.56 15630 (msg: "Storm worm phone home address 159.83.130.56\:15630"; sid: 1055555; rev: 1;)
alert tcp $HOME_NET any -> 159.83.153.133 19400 (msg: "Storm worm phone home address 159.83.153.133\:19400"; sid: 1055556; rev: 1;)
alert tcp $HOME_NET any -> 163.150.235.162 33013 (msg: "Storm worm phone home address 163.150.235.162\:33013"; sid: 1055557; rev: 1;)
alert tcp $HOME_NET any -> 164.116.81.100 22252 (msg: "Storm worm phone home address 164.116.81.100\:22252"; sid: 1055558; rev: 1;)
alert tcp $HOME_NET any -> 165.138.254.1 28235 (msg: "Storm worm phone home address 165.138.254.1\:28235"; sid: 1055559; rev: 1;)
alert tcp $HOME_NET any -> 165.139.64.181 26807 (msg: "Storm worm phone home address 165.139.64.181\:26807"; sid: 1055560; rev: 1;)
alert tcp $HOME_NET any -> 166.129.132.241 33069 (msg: "Storm worm phone home address 166.129.132.241\:33069"; sid: 1055561; rev: 1;)
alert tcp $HOME_NET any -> 166.214.194.15 24504 (msg: "Storm worm phone home address 166.214.194.15\:24504"; sid: 1055562; rev: 1;)
alert tcp $HOME_NET any -> 168.234.199.130 3853 (msg: "Storm worm phone home address 168.234.199.130\:3853"; sid: 1055563; rev: 1;)
alert tcp $HOME_NET any -> 189.12.59.46 26099 (msg: "Storm worm phone home address 189.12.59.46\:26099"; sid: 1055564; rev: 1;)
alert tcp $HOME_NET any -> 189.128.125.220 31919 (msg: "Storm worm phone home address 189.128.125.220\:31919"; sid: 1055565; rev: 1;)
alert tcp $HOME_NET any -> 189.143.51.111 33699 (msg: "Storm worm phone home address 189.143.51.111\:33699"; sid: 1055566; rev: 1;)
alert tcp $HOME_NET any -> 189.169.49.72 21716 (msg: "Storm worm phone home address 189.169.49.72\:21716"; sid: 1055567; rev: 1;)
alert tcp $HOME_NET any -> 189.173.46.194 27180 (msg: "Storm worm phone home address 189.173.46.194\:27180"; sid: 1055568; rev: 1;)
alert tcp $HOME_NET any -> 189.182.65.175 5019 (msg: "Storm worm phone home address 189.182.65.175\:5019"; sid: 1055569; rev: 1;)
alert tcp $HOME_NET any -> 189.25.182.153 8172 (msg: "Storm worm phone home address 189.25.182.153\:8172"; sid: 1055570; rev: 1;)
alert tcp $HOME_NET any -> 189.30.182.5 18782 (msg: "Storm worm phone home address 189.30.182.5\:18782"; sid: 1055571; rev: 1;)
alert tcp $HOME_NET any -> 189.3.174.137 12984 (msg: "Storm worm phone home address 189.3.174.137\:12984"; sid: 1055572; rev: 1;)
alert tcp $HOME_NET any -> 189.53.56.64 13108 (msg: "Storm worm phone home address 189.53.56.64\:13108"; sid: 1055573; rev: 1;)
alert tcp $HOME_NET any -> 190.129.80.105 26708 (msg: "Storm worm phone home address 190.129.80.105\:26708"; sid: 1055574; rev: 1;)
alert tcp $HOME_NET any -> 190.144.46.34 29140 (msg: "Storm worm phone home address 190.144.46.34\:29140"; sid: 1055575; rev: 1;)
alert tcp $HOME_NET any -> 190.199.245.170 4839 (msg: "Storm worm phone home address 190.199.245.170\:4839"; sid: 1055576; rev: 1;)
alert tcp $HOME_NET any -> 190.210.17.57 28758 (msg: "Storm worm phone home address 190.210.17.57\:28758"; sid: 1055577; rev: 1;)
alert tcp $HOME_NET any -> 190.30.105.76 18954 (msg: "Storm worm phone home address 190.30.105.76\:18954"; sid: 1055578; rev: 1;)
alert tcp $HOME_NET any -> 190.30.233.182 23453 (msg: "Storm worm phone home address 190.30.233.182\:23453"; sid: 1055579; rev: 1;)
alert tcp $HOME_NET any -> 190.3.210.54 16728 (msg: "Storm worm phone home address 190.3.210.54\:16728"; sid: 1055580; rev: 1;)
alert tcp $HOME_NET any -> 190.39.223.119 19027 (msg: "Storm worm phone home address 190.39.223.119\:19027"; sid: 1055581; rev: 1;)
alert tcp $HOME_NET any -> 190.41.213.53 3390 (msg: "Storm worm phone home address 190.41.213.53\:3390"; sid: 1055582; rev: 1;)
alert tcp $HOME_NET any -> 190.42.31.225 21540 (msg: "Storm worm phone home address 190.42.31.225\:21540"; sid: 1055583; rev: 1;)
alert tcp $HOME_NET any -> 190.42.15.139 12109 (msg: "Storm worm phone home address 190.42.15.139\:12109"; sid: 1055584; rev: 1;)
alert tcp $HOME_NET any -> 190.43.143.146 3437 (msg: "Storm worm phone home address 190.43.143.146\:3437"; sid: 1055585; rev: 1;)
alert tcp $HOME_NET any -> 190.47.178.132 21433 (msg: "Storm worm phone home address 190.47.178.132\:21433"; sid: 1055586; rev: 1;)
alert tcp $HOME_NET any -> 190.53.4.131 27583 (msg: "Storm worm phone home address 190.53.4.131\:27583"; sid: 1055587; rev: 1;)
alert tcp $HOME_NET any -> 190.54.29.250 30422 (msg: "Storm worm phone home address 190.54.29.250\:30422"; sid: 1055588; rev: 1;)
alert tcp $HOME_NET any -> 190.66.249.192 22651 (msg: "Storm worm phone home address 190.66.249.192\:22651"; sid: 1055589; rev: 1;)
alert tcp $HOME_NET any -> 190.67.138.87 13820 (msg: "Storm worm phone home address 190.67.138.87\:13820"; sid: 1055590; rev: 1;)
alert tcp $HOME_NET any -> 190.81.58.177 27875 (msg: "Storm worm phone home address 190.81.58.177\:27875"; sid: 1055591; rev: 1;)
alert tcp $HOME_NET any -> 190.95.160.183 20597 (msg: "Storm worm phone home address 190.95.160.183\:20597"; sid: 1055592; rev: 1;)
alert tcp $HOME_NET any -> 193.110.113.223 25499 (msg: "Storm worm phone home address 193.110.113.223\:25499"; sid: 1055593; rev: 1;)
alert tcp $HOME_NET any -> 193.138.140.17 27429 (msg: "Storm worm phone home address 193.138.140.17\:27429"; sid: 1055594; rev: 1;)
alert tcp $HOME_NET any -> 193.239.179.130 16595 (msg: "Storm worm phone home address 193.239.179.130\:16595"; sid: 1055595; rev: 1;)
alert tcp $HOME_NET any -> 193.254.224.81 5963 (msg: "Storm worm phone home address 193.254.224.81\:5963"; sid: 1055596; rev: 1;)
alert tcp $HOME_NET any -> 193.34.174.20 11950 (msg: "Storm worm phone home address 193.34.174.20\:11950"; sid: 1055597; rev: 1;)
alert tcp $HOME_NET any -> 194.149.88.215 25863 (msg: "Storm worm phone home address 194.149.88.215\:25863"; sid: 1055598; rev: 1;)
alert tcp $HOME_NET any -> 194.187.55.154 9754 (msg: "Storm worm phone home address 194.187.55.154\:9754"; sid: 1055599; rev: 1;)
alert tcp $HOME_NET any -> 194.33.189.197 33309 (msg: "Storm worm phone home address 194.33.189.197\:33309"; sid: 1055600; rev: 1;)
alert tcp $HOME_NET any -> 194.44.18.73 31332 (msg: "Storm worm phone home address 194.44.18.73\:31332"; sid: 1055601; rev: 1;)
alert tcp $HOME_NET any -> 194.44.40.145 32738 (msg: "Storm worm phone home address 194.44.40.145\:32738"; sid: 1055602; rev: 1;)
alert tcp $HOME_NET any -> 195.146.253.159 29586 (msg: "Storm worm phone home address 195.146.253.159\:29586"; sid: 1055603; rev: 1;)
alert tcp $HOME_NET any -> 195.189.80.53 28437 (msg: "Storm worm phone home address 195.189.80.53\:28437"; sid: 1055604; rev: 1;)
alert tcp $HOME_NET any -> 195.238.190.248 5757 (msg: "Storm worm phone home address 195.238.190.248\:5757"; sid: 1055605; rev: 1;)
alert tcp $HOME_NET any -> 195.239.198.227 7288 (msg: "Storm worm phone home address 195.239.198.227\:7288"; sid: 1055606; rev: 1;)
alert tcp $HOME_NET any -> 195.245.97.242 22312 (msg: "Storm worm phone home address 195.245.97.242\:22312"; sid: 1055607; rev: 1;)
alert tcp $HOME_NET any -> 195.245.97.41 13224 (msg: "Storm worm phone home address 195.245.97.41\:13224"; sid: 1055608; rev: 1;)
alert tcp $HOME_NET any -> 195.64.140.21 13284 (msg: "Storm worm phone home address 195.64.140.21\:13284"; sid: 1055609; rev: 1;)
alert tcp $HOME_NET any -> 195.64.179.39 2236 (msg: "Storm worm phone home address 195.64.179.39\:2236"; sid: 1055610; rev: 1;)
alert tcp $HOME_NET any -> 195.78.45.138 31632 (msg: "Storm worm phone home address 195.78.45.138\:31632"; sid: 1055611; rev: 1;)
alert tcp $HOME_NET any -> 195.82.160.1 13404 (msg: "Storm worm phone home address 195.82.160.1\:13404"; sid: 1055612; rev: 1;)
alert tcp $HOME_NET any -> 196.203.177.10 28115 (msg: "Storm worm phone home address 196.203.177.10\:28115"; sid: 1055613; rev: 1;)
alert tcp $HOME_NET any -> 196.206.219.94 28771 (msg: "Storm worm phone home address 196.206.219.94\:28771"; sid: 1055614; rev: 1;)
alert tcp $HOME_NET any -> 196.209.78.171 9600 (msg: "Storm worm phone home address 196.209.78.171\:9600"; sid: 1055615; rev: 1;)
alert tcp $HOME_NET any -> 196.217.29.40 2163 (msg: "Storm worm phone home address 196.217.29.40\:2163"; sid: 1055616; rev: 1;)
alert tcp $HOME_NET any -> 196.218.242.154 25246 (msg: "Storm worm phone home address 196.218.242.154\:25246"; sid: 1055617; rev: 1;)
alert tcp $HOME_NET any -> 198.109.51.252 20309 (msg: "Storm worm phone home address 198.109.51.252\:20309"; sid: 1055618; rev: 1;)
alert tcp $HOME_NET any -> 199.222.169.102 16196 (msg: "Storm worm phone home address 199.222.169.102\:16196"; sid: 1055619; rev: 1;)
alert tcp $HOME_NET any -> 200.114.216.149 27746 (msg: "Storm worm phone home address 200.114.216.149\:27746"; sid: 1055620; rev: 1;)
alert tcp $HOME_NET any -> 200.121.227.227 8798 (msg: "Storm worm phone home address 200.121.227.227\:8798"; sid: 1055621; rev: 1;)
alert tcp $HOME_NET any -> 200.121.178.181 4067 (msg: "Storm worm phone home address 200.121.178.181\:4067"; sid: 1055622; rev: 1;)
alert tcp $HOME_NET any -> 200.140.128.115 11757 (msg: "Storm worm phone home address 200.140.128.115\:11757"; sid: 1055623; rev: 1;)
alert tcp $HOME_NET any -> 200.164.118.198 29003 (msg: "Storm worm phone home address 200.164.118.198\:29003"; sid: 1055624; rev: 1;)
alert tcp $HOME_NET any -> 200.168.234.138 22505 (msg: "Storm worm phone home address 200.168.234.138\:22505"; sid: 1055625; rev: 1;)
alert tcp $HOME_NET any -> 200.195.111.227 26022 (msg: "Storm worm phone home address 200.195.111.227\:26022"; sid: 1055626; rev: 1;)
alert tcp $HOME_NET any -> 200.206.127.42 6748 (msg: "Storm worm phone home address 200.206.127.42\:6748"; sid: 1055627; rev: 1;)
alert tcp $HOME_NET any -> 200.209.128.106 26442 (msg: "Storm worm phone home address 200.209.128.106\:26442"; sid: 1055628; rev: 1;)
alert tcp $HOME_NET any -> 200.37.123.31 3887 (msg: "Storm worm phone home address 200.37.123.31\:3887"; sid: 1055629; rev: 1;)
alert tcp $HOME_NET any -> 200.38.239.253 3578 (msg: "Storm worm phone home address 200.38.239.253\:3578"; sid: 1055630; rev: 1;)
alert tcp $HOME_NET any -> 200.42.190.162 19940 (msg: "Storm worm phone home address 200.42.190.162\:19940"; sid: 1055631; rev: 1;)
alert tcp $HOME_NET any -> 200.43.121.253 3861 (msg: "Storm worm phone home address 200.43.121.253\:3861"; sid: 1055632; rev: 1;)
alert tcp $HOME_NET any -> 200.48.253.243 16312 (msg: "Storm worm phone home address 200.48.253.243\:16312"; sid: 1055633; rev: 1;)
alert tcp $HOME_NET any -> 200.52.130.13 32884 (msg: "Storm worm phone home address 200.52.130.13\:32884"; sid: 1055634; rev: 1;)
alert tcp $HOME_NET any -> 200.54.72.138 8339 (msg: "Storm worm phone home address 200.54.72.138\:8339"; sid: 1055635; rev: 1;)
alert tcp $HOME_NET any -> 200.89.159.214 24023 (msg: "Storm worm phone home address 200.89.159.214\:24023"; sid: 1055636; rev: 1;)
alert tcp $HOME_NET any -> 200.96.63.2 17813 (msg: "Storm worm phone home address 200.96.63.2\:17813"; sid: 1055637; rev: 1;)
alert tcp $HOME_NET any -> 201.116.111.211 8356 (msg: "Storm worm phone home address 201.116.111.211\:8356"; sid: 1055638; rev: 1;)
alert tcp $HOME_NET any -> 201.14.60.127 5152 (msg: "Storm worm phone home address 201.14.60.127\:5152"; sid: 1055639; rev: 1;)
alert tcp $HOME_NET any -> 201.19.107.135 10921 (msg: "Storm worm phone home address 201.19.107.135\:10921"; sid: 1055640; rev: 1;)
alert tcp $HOME_NET any -> 201.210.255.83 23466 (msg: "Storm worm phone home address 201.210.255.83\:23466"; sid: 1055641; rev: 1;)
alert tcp $HOME_NET any -> 201.213.131.85 19061 (msg: "Storm worm phone home address 201.213.131.85\:19061"; sid: 1055642; rev: 1;)
alert tcp $HOME_NET any -> 201.231.51.19 7078 (msg: "Storm worm phone home address 201.231.51.19\:7078"; sid: 1055643; rev: 1;)
alert tcp $HOME_NET any -> 201.234.80.20 31379 (msg: "Storm worm phone home address 201.234.80.20\:31379"; sid: 1055644; rev: 1;)
alert tcp $HOME_NET any -> 201.238.201.228 16578 (msg: "Storm worm phone home address 201.238.201.228\:16578"; sid: 1055645; rev: 1;)
alert tcp $HOME_NET any -> 201.240.225.239 31074 (msg: "Storm worm phone home address 201.240.225.239\:31074"; sid: 1055646; rev: 1;)
alert tcp $HOME_NET any -> 201.240.95.122 15823 (msg: "Storm worm phone home address 201.240.95.122\:15823"; sid: 1055647; rev: 1;)
alert tcp $HOME_NET any -> 201.245.145.41 28655 (msg: "Storm worm phone home address 201.245.145.41\:28655"; sid: 1055648; rev: 1;)
alert tcp $HOME_NET any -> 201.246.255.101 16762 (msg: "Storm worm phone home address 201.246.255.101\:16762"; sid: 1055649; rev: 1;)
alert tcp $HOME_NET any -> 201.25.88.151 1185 (msg: "Storm worm phone home address 201.25.88.151\:1185"; sid: 1055650; rev: 1;)
alert tcp $HOME_NET any -> 201.253.36.199 11075 (msg: "Storm worm phone home address 201.253.36.199\:11075"; sid: 1055651; rev: 1;)
alert tcp $HOME_NET any -> 201.255.31.130 10256 (msg: "Storm worm phone home address 201.255.31.130\:10256"; sid: 1055652; rev: 1;)
alert tcp $HOME_NET any -> 201.52.81.197 20142 (msg: "Storm worm phone home address 201.52.81.197\:20142"; sid: 1055653; rev: 1;)
alert tcp $HOME_NET any -> 201.6.51.86 14618 (msg: "Storm worm phone home address 201.6.51.86\:14618"; sid: 1055654; rev: 1;)
alert tcp $HOME_NET any -> 201.62.154.254 5993 (msg: "Storm worm phone home address 201.62.154.254\:5993"; sid: 1055655; rev: 1;)
alert tcp $HOME_NET any -> 201.78.231.22 20837 (msg: "Storm worm phone home address 201.78.231.22\:20837"; sid: 1055656; rev: 1;)
alert tcp $HOME_NET any -> 201.81.174.243 24028 (msg: "Storm worm phone home address 201.81.174.243\:24028"; sid: 1055657; rev: 1;)
alert tcp $HOME_NET any -> 202.1.204.225 5843 (msg: "Storm worm phone home address 202.1.204.225\:5843"; sid: 1055658; rev: 1;)
alert tcp $HOME_NET any -> 202.148.205.139 30963 (msg: "Storm worm phone home address 202.148.205.139\:30963"; sid: 1055659; rev: 1;)
alert tcp $HOME_NET any -> 203.143.25.99 28591 (msg: "Storm worm phone home address 203.143.25.99\:28591"; sid: 1055660; rev: 1;)
alert tcp $HOME_NET any -> 203.186.19.109 4934 (msg: "Storm worm phone home address 203.186.19.109\:4934"; sid: 1055661; rev: 1;)
alert tcp $HOME_NET any -> 203.187.232.103 14897 (msg: "Storm worm phone home address 203.187.232.103\:14897"; sid: 1055662; rev: 1;)
alert tcp $HOME_NET any -> 203.218.156.131 18834 (msg: "Storm worm phone home address 203.218.156.131\:18834"; sid: 1055663; rev: 1;)
alert tcp $HOME_NET any -> 203.81.202.113 7897 (msg: "Storm worm phone home address 203.81.202.113\:7897"; sid: 1055664; rev: 1;)
alert tcp $HOME_NET any -> 203.82.113.167 15111 (msg: "Storm worm phone home address 203.82.113.167\:15111"; sid: 1055665; rev: 1;)
alert tcp $HOME_NET any -> 203.87.177.46 21090 (msg: "Storm worm phone home address 203.87.177.46\:21090"; sid: 1055666; rev: 1;)
alert tcp $HOME_NET any -> 205.174.124.116 10964 (msg: "Storm worm phone home address 205.174.124.116\:10964"; sid: 1055667; rev: 1;)
alert tcp $HOME_NET any -> 205.211.201.107 28788 (msg: "Storm worm phone home address 205.211.201.107\:28788"; sid: 1055668; rev: 1;)
alert tcp $HOME_NET any -> 205.237.60.76 24328 (msg: "Storm worm phone home address 205.237.60.76\:24328"; sid: 1055669; rev: 1;)
alert tcp $HOME_NET any -> 206.166.81.146 21150 (msg: "Storm worm phone home address 206.166.81.146\:21150"; sid: 1055670; rev: 1;)
alert tcp $HOME_NET any -> 207.102.202.122 33575 (msg: "Storm worm phone home address 207.102.202.122\:33575"; sid: 1055671; rev: 1;)
alert tcp $HOME_NET any -> 207.151.97.1 18984 (msg: "Storm worm phone home address 207.151.97.1\:18984"; sid: 1055672; rev: 1;)
alert tcp $HOME_NET any -> 207.210.53.101 16968 (msg: "Storm worm phone home address 207.210.53.101\:16968"; sid: 1055673; rev: 1;)
alert tcp $HOME_NET any -> 208.120.111.80 32914 (msg: "Storm worm phone home address 208.120.111.80\:32914"; sid: 1055674; rev: 1;)
alert tcp $HOME_NET any -> 208.180.132.128 29367 (msg: "Storm worm phone home address 208.180.132.128\:29367"; sid: 1055675; rev: 1;)
alert tcp $HOME_NET any -> 209.101.172.1 4972 (msg: "Storm worm phone home address 209.101.172.1\:4972"; sid: 1055676; rev: 1;)
alert tcp $HOME_NET any -> 210.143.159.154 1155 (msg: "Storm worm phone home address 210.143.159.154\:1155"; sid: 1055677; rev: 1;)
alert tcp $HOME_NET any -> 210.7.21.170 5757 (msg: "Storm worm phone home address 210.7.21.170\:5757"; sid: 1055678; rev: 1;)
alert tcp $HOME_NET any -> 212.119.56.74 19087 (msg: "Storm worm phone home address 212.119.56.74\:19087"; sid: 1055679; rev: 1;)
alert tcp $HOME_NET any -> 212.239.144.135 13340 (msg: "Storm worm phone home address 212.239.144.135\:13340"; sid: 1055680; rev: 1;)
alert tcp $HOME_NET any -> 212.25.47.32 26189 (msg: "Storm worm phone home address 212.25.47.32\:26189"; sid: 1055681; rev: 1;)
alert tcp $HOME_NET any -> 212.25.60.237 17646 (msg: "Storm worm phone home address 212.25.60.237\:17646"; sid: 1055682; rev: 1;)
alert tcp $HOME_NET any -> 213.132.80.6 16278 (msg: "Storm worm phone home address 213.132.80.6\:16278"; sid: 1055683; rev: 1;)
alert tcp $HOME_NET any -> 213.141.151.224 29972 (msg: "Storm worm phone home address 213.141.151.224\:29972"; sid: 1055684; rev: 1;)
alert tcp $HOME_NET any -> 213.145.45.254 3647 (msg: "Storm worm phone home address 213.145.45.254\:3647"; sid: 1055685; rev: 1;)
alert tcp $HOME_NET any -> 213.154.213.197 8579 (msg: "Storm worm phone home address 213.154.213.197\:8579"; sid: 1055686; rev: 1;)
alert tcp $HOME_NET any -> 213.157.245.95 29183 (msg: "Storm worm phone home address 213.157.245.95\:29183"; sid: 1055687; rev: 1;)
alert tcp $HOME_NET any -> 213.171.61.138 8682 (msg: "Storm worm phone home address 213.171.61.138\:8682"; sid: 1055688; rev: 1;)
alert tcp $HOME_NET any -> 213.226.15.61 1597 (msg: "Storm worm phone home address 213.226.15.61\:1597"; sid: 1055689; rev: 1;)
alert tcp $HOME_NET any -> 213.238.84.88 31941 (msg: "Storm worm phone home address 213.238.84.88\:31941"; sid: 1055690; rev: 1;)
alert tcp $HOME_NET any -> 213.85.160.46 31692 (msg: "Storm worm phone home address 213.85.160.46\:31692"; sid: 1055691; rev: 1;)
alert tcp $HOME_NET any -> 213.91.140.30 6945 (msg: "Storm worm phone home address 213.91.140.30\:6945"; sid: 1055692; rev: 1;)
alert tcp $HOME_NET any -> 213.92.129.163 8922 (msg: "Storm worm phone home address 213.92.129.163\:8922"; sid: 1055693; rev: 1;)
alert tcp $HOME_NET any -> 216.139.142.17 10788 (msg: "Storm worm phone home address 216.139.142.17\:10788"; sid: 1055694; rev: 1;)
alert tcp $HOME_NET any -> 216.143.83.99 19696 (msg: "Storm worm phone home address 216.143.83.99\:19696"; sid: 1055695; rev: 1;)
alert tcp $HOME_NET any -> 216.72.178.28 15360 (msg: "Storm worm phone home address 216.72.178.28\:15360"; sid: 1055696; rev: 1;)
alert tcp $HOME_NET any -> 216.79.175.247 2463 (msg: "Storm worm phone home address 216.79.175.247\:2463"; sid: 1055697; rev: 1;)
alert tcp $HOME_NET any -> 217.159.171.203 6349 (msg: "Storm worm phone home address 217.159.171.203\:6349"; sid: 1055698; rev: 1;)
alert tcp $HOME_NET any -> 217.196.213.177 22715 (msg: "Storm worm phone home address 217.196.213.177\:22715"; sid: 1055699; rev: 1;)
alert tcp $HOME_NET any -> 217.197.113.44 18092 (msg: "Storm worm phone home address 217.197.113.44\:18092"; sid: 1055700; rev: 1;)
alert tcp $HOME_NET any -> 217.197.156.252 7151 (msg: "Storm worm phone home address 217.197.156.252\:7151"; sid: 1055701; rev: 1;)
alert tcp $HOME_NET any -> 217.202.61.159 18178 (msg: "Storm worm phone home address 217.202.61.159\:18178"; sid: 1055702; rev: 1;)
alert tcp $HOME_NET any -> 217.219.12.152 13108 (msg: "Storm worm phone home address 217.219.12.152\:13108"; sid: 1055703; rev: 1;)
alert tcp $HOME_NET any -> 217.77.54.253 12358 (msg: "Storm worm phone home address 217.77.54.253\:12358"; sid: 1055704; rev: 1;)
alert tcp $HOME_NET any -> 218.225.195.229 31739 (msg: "Storm worm phone home address 218.225.195.229\:31739"; sid: 1055705; rev: 1;)
alert tcp $HOME_NET any -> 219.71.212.185 32232 (msg: "Storm worm phone home address 219.71.212.185\:32232"; sid: 1055706; rev: 1;)
alert tcp $HOME_NET any -> 219.78.178.251 33150 (msg: "Storm worm phone home address 219.78.178.251\:33150"; sid: 1055707; rev: 1;)
alert tcp $HOME_NET any -> 219.79.248.46 11543 (msg: "Storm worm phone home address 219.79.248.46\:11543"; sid: 1055708; rev: 1;)
alert tcp $HOME_NET any -> 222.252.232.184 22861 (msg: "Storm worm phone home address 222.252.232.184\:22861"; sid: 1055709; rev: 1;)
alert tcp $HOME_NET any -> 222.33.177.224 12255 (msg: "Storm worm phone home address 222.33.177.224\:12255"; sid: 1055710; rev: 1;)