# DNS Zeus rules by Jack Pepper ( pepperjack@autoshun.org ) # regenerated periodically from the domains file at abuse.ch # The URL for the abuse.ch site: https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist # The source URL for this http://www.autoshun.org/downloads/zeusdomain.rules # # # Mon, 06 Sep 2010 02:15:03 -0500 # Error on ############################################################################## # Error on # abuse.ch ZeuS domain blocklist # # Error on # # # Error on # For questions please referer to https://zeustracker.abuse.ch/blocklist.php # # Error on ############################################################################## # Error on alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 001.bladespoon.cn"; content:"|03|001|0a|bladespoon|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129091; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 005.twoshekels.com"; content:"|03|005|0a|twoshekels|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129092; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 01.coolw.in"; content:"|02|01|05|coolw|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129093; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 01.yxian.in"; content:"|02|01|05|yxian|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129094; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 02.coolw.in"; content:"|02|02|05|coolw|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129095; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 02.yxian.in"; content:"|02|02|05|yxian|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129096; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 0md.ru"; content:"|03|0md|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129097; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 1.vin4enso.cz8.ru"; content:"|01|1|08|vin4enso|03|cz8|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129098; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 111.gosdfsdjas.com"; content:"|03|111|0a|gosdfsdjas|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129099; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 11sp.co.tv"; content:"|04|11sp|02|co|02|tv"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129100; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 1337.bnetinvaderz.com"; content:"|04|1337|0c|bnetinvaderz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129101; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 13666.ru"; content:"|05|13666|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129102; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 15.bawbw.in"; content:"|02|15|05|bawbw|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129103; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 19sesse.co.cc"; content:"|07|19sesse|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129104; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 1iii.org"; content:"|04|1iii|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129105; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 1pulenepro.net"; content:"|0a|1pulenepro|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129106; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 2012babah2012.com"; content:"|0d|2012babah2012|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129107; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 221212121.ru"; content:"|09|221212121|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129108; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 2gunz.no-ip.info"; content:"|05|2gunz|05|no-ip|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129109; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 2pulenepro.net"; content:"|0a|2pulenepro|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129110; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 32002349293.com"; content:"|0b|32002349293|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129111; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 32094820349.com"; content:"|0b|32094820349|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129112; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3214099021.com"; content:"|0a|3214099021|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129113; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 32874239049394.com"; content:"|0e|32874239049394|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129114; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 333.aaszxy.ru"; content:"|03|333|06|aaszxy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129115; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3405902934059.com"; content:"|0d|3405902934059|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129116; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 349023094903.com"; content:"|0c|349023094903|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129117; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 349209233.com"; content:"|09|349209233|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129118; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 34real.ru"; content:"|06|34real|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129119; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 365wowstore.com"; content:"|0b|365wowstore|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129120; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3gcompanyplc.com"; content:"|0c|3gcompanyplc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129121; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3m70.cn"; content:"|04|3m70|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129122; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3weselchak.net"; content:"|0a|3weselchak|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129123; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3x55conto.nu"; content:"|09|3x55conto|02|nu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129124; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 40aoz.sanjianistatistics.info"; content:"|05|40aoz|12|sanjianistatistics|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129125; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 4238789324.com"; content:"|0a|4238789324|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129126; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 458928409.com"; content:"|09|458928409|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129127; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 663se2s.co.cc"; content:"|07|663se2s|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129128; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 688set.co.cc"; content:"|06|688set|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129129; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 6orod.in"; content:"|05|6orod|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129130; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 753123.cn"; content:"|06|753123|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129131; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 777yo777.cn"; content:"|08|777yo777|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129132; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 82801se.co.cc"; content:"|07|82801se|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129133; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 842389423478923.com"; content:"|0f|842389423478923|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129134; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 8gbnews.com"; content:"|07|8gbnews|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129135; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 8string.ru"; content:"|07|8string|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129136; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 931125s.co.cc"; content:"|07|931125s|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129137; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain a.deluge.biz"; content:"|01|a|06|deluge|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129138; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain a.deluge.co.in"; content:"|01|a|06|deluge|02|co|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129139; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain a.sodfirst.com"; content:"|01|a|08|sodfirst|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129140; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain a.z2oplusm.net"; content:"|01|a|08|z2oplusm|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129141; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aa419.ru"; content:"|05|aa419|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129142; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aaa.fozdegen.com"; content:"|03|aaa|08|fozdegen|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129143; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aaarrr.bulletprof.net"; content:"|06|aaarrr|0a|bulletprof|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129144; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aaic.ru"; content:"|04|aaic|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129145; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aaiv.ru"; content:"|04|aaiv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129146; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aaqx.ru"; content:"|04|aaqx|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129147; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aasdaafs.wapdodoit.ru"; content:"|08|aasdaafs|09|wapdodoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129148; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aaszxr.ru"; content:"|06|aaszxr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129149; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ab100jskd.com"; content:"|09|ab100jskd|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129150; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain abagnalefrankiezeus.net"; content:"|13|abagnalefrankiezeus|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129151; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ac100djsdhg.com"; content:"|0b|ac100djsdhg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129152; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain acdhmegathr.com"; content:"|0b|acdhmegathr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129153; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ad1.alzaabi.org"; content:"|03|ad1|07|alzaabi|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129154; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adaichaepo.ru"; content:"|0a|adaichaepo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129155; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adewright.com"; content:"|09|adewright|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129156; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adidas35.freehostia.com"; content:"|08|adidas35|0a|freehostia|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129157; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain admcp21.cn"; content:"|07|admcp21|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129158; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adminacces.com"; content:"|0a|adminacces|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129159; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe1-erbireal.cn"; content:"|0f|adobe1-erbireal|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129160; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe10-togeam.cn"; content:"|0e|adobe10-togeam|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129161; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe2-joek.cn"; content:"|0b|adobe2-joek|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129162; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe4-natdup.cn"; content:"|0d|adobe4-natdup|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129163; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe5-peltion.cn"; content:"|0e|adobe5-peltion|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129164; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe7-jildyp.cn"; content:"|0d|adobe7-jildyp|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129165; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe8-muts.cn"; content:"|0b|adobe8-muts|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129166; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobe9-mytdup.cn"; content:"|0d|adobe9-mytdup|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129167; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobeactivation.net"; content:"|0f|adobeactivation|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129168; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adobeserverupdate.com"; content:"|11|adobeserverupdate|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129169; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adspromo.cn"; content:"|08|adspromo|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129170; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain advdomain235.com"; content:"|0c|advdomain235|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129171; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adwarecheck.net"; content:"|0b|adwarecheck|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129172; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adwordsformoney.cn"; content:"|0f|adwordsformoney|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129173; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aerostuff.ru"; content:"|09|aerostuff|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129174; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aervrfhu.ru"; content:"|08|aervrfhu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129175; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aggood.net"; content:"|06|aggood|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129176; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ago1980.ag.funpic.org"; content:"|07|ago1980|02|ag|06|funpic|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129177; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain agreedframework.com"; content:"|0f|agreedframework|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129178; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aibieviake.ru"; content:"|0a|aibieviake|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129179; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aijohcolev.ru"; content:"|0a|aijohcolev|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129180; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ajijpqhathr.com"; content:"|0b|ajijpqhathr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129181; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ajjh.ru"; content:"|04|ajjh|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129182; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain akapulkoparmitana.ws"; content:"|11|akapulkoparmitana|02|ws"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129183; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alabayss.com"; content:"|08|alabayss|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129184; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aleksgood.real-host.ru"; content:"|09|aleksgood|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129185; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alert35.com.tw"; content:"|07|alert35|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129186; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alfastream.cn"; content:"|0a|alfastream|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129187; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain allibeybeach.com"; content:"|0c|allibeybeach|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129188; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alliedaeon.com"; content:"|0a|alliedaeon|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129189; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aloa.asia"; content:"|04|aloa|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129190; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alsons.ru"; content:"|06|alsons|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129191; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alssayer.ws"; content:"|08|alssayer|02|ws"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129192; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain altmaforbetchrono00000.net"; content:"|16|altmaforbetchrono00000|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129193; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alwaysky.cn"; content:"|08|alwaysky|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129194; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amar-co.si"; content:"|07|amar-co|02|si"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129195; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amebas.cn"; content:"|06|amebas|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129196; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ammew.info"; content:"|05|ammew|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129197; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amring.ru"; content:"|06|amring|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129198; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amsterdamtoteheran.nl"; content:"|12|amsterdamtoteheran|02|nl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129199; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain an-freeeze.cn"; content:"|0a|an-freeeze|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129200; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain analf.net"; content:"|05|analf|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129201; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain analigesto.com"; content:"|0a|analigesto|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129202; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain analytics2.org"; content:"|0a|analytics2|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129203; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain andige.net"; content:"|06|andige|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129204; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain andrej.andreev12.pochta.ru"; content:"|06|andrej|09|andreev12|06|pochta|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129205; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain androzo.ru"; content:"|07|androzo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129206; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain antidopings.cn"; content:"|0b|antidopings|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129207; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain antispamerteam.com"; content:"|0e|antispamerteam|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129208; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain antitake.co.cc"; content:"|08|antitake|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129209; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain antivir-online.co.cc"; content:"|0e|antivir-online|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129210; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain anyhimi.cn"; content:"|07|anyhimi|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129211; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain anysearchweb.ru"; content:"|0c|anysearchweb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129212; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aolas.cn"; content:"|05|aolas|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129213; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain apollo.deltasystem.cl"; content:"|06|apollo|0b|deltasystem|02|cl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129214; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain apsight.ru"; content:"|07|apsight|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129215; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aqqx.ru"; content:"|04|aqqx|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129216; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain araaa.wapdodoit.ru"; content:"|05|araaa|09|wapdodoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129217; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain archivopc.com.v-ddr.ru"; content:"|09|archivopc|03|com|05|v-ddr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129218; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ardhmeria-juaj.com"; content:"|0e|ardhmeria-juaj|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129219; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain argentinos.zapto.org"; content:"|0a|argentinos|05|zapto|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129220; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain armyrats.com"; content:"|08|armyrats|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129221; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aroolohnet.ru"; content:"|0a|aroolohnet|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129222; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain arsenalik.ru"; content:"|09|arsenalik|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129223; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain artrestn.ru"; content:"|08|artrestn|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129224; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain arturfiles677.name"; content:"|0d|arturfiles677|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129225; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain arturpirozhkov00.name"; content:"|10|arturpirozhkov00|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129226; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain asbridgesburn.biz"; content:"|0d|asbridgesburn|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129227; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain asf.wdn.com"; content:"|03|asf|03|wdn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129228; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ashkeytra.com"; content:"|09|ashkeytra|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129229; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain asiadomens.su"; content:"|0a|asiadomens|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129230; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain askuv.com"; content:"|05|askuv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129231; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aslrr.com"; content:"|05|aslrr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129232; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain asmodey.bh5.ru"; content:"|07|asmodey|03|bh5|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129233; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain assdazzxcad.cn"; content:"|0b|assdazzxcad|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129234; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain assde.asia"; content:"|05|assde|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129235; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain assolo.ru"; content:"|06|assolo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129236; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain astramani.ru"; content:"|09|astramani|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129237; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain asyea.ru"; content:"|05|asyea|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129238; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain atcer.lx.ro"; content:"|05|atcer|02|lx|02|ro"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129239; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ath8net.com"; content:"|07|ath8net|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129240; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain atheistjkghk3242.info"; content:"|10|atheistjkghk3242|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129241; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain atlascounter.com"; content:"|0c|atlascounter|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129242; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aussiebob.com"; content:"|09|aussiebob|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129243; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain autasienga.ru"; content:"|0a|autasienga|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129244; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain automon.com.cn"; content:"|07|automon|03|com|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129245; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain autoparck.sumy.ua"; content:"|09|autoparck|04|sumy|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129246; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain avalaz.net"; content:"|06|avalaz|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129247; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain avtomoto.limewebs.com"; content:"|08|avtomoto|08|limewebs|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129248; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain awawu.cn"; content:"|05|awawu|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129249; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain awtextile.com"; content:"|09|awtextile|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129250; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain azurcorporation.com"; content:"|0f|azurcorporation|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129251; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b.chto.su"; content:"|01|b|04|chto|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129252; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b0fs.com"; content:"|04|b0fs|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129253; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b18c.cn"; content:"|04|b18c|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129254; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b1sh0p.ru"; content:"|06|b1sh0p|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129255; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b1shop.cc"; content:"|06|b1shop|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129256; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b1shop.cn"; content:"|06|b1shop|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129257; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b1xs.com"; content:"|04|b1xs|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129258; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b2bdebtcollection.co.uk"; content:"|11|b2bdebtcollection|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129259; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain b2bdebtrecovery.co.uk"; content:"|0f|b2bdebtrecovery|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129260; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bacalavala.com.es"; content:"|0a|bacalavala|03|com|02|es"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129261; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bahoy.net"; content:"|05|bahoy|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129262; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain banan-service.org"; content:"|0d|banan-service|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129263; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bananajuice21.net"; content:"|0d|bananajuice21|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129264; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bandikots.com"; content:"|09|bandikots|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129265; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bankolocate.cn"; content:"|0b|bankolocate|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129266; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain banktrustservice.cn"; content:"|10|banktrustservice|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129267; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain baqrr.ru"; content:"|05|baqrr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129268; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain barakobrama.com"; content:"|0b|barakobrama|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129269; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain barraccuda.cn"; content:"|0a|barraccuda|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129270; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain base1925.net"; content:"|08|base1925|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129271; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain basicasco.ru"; content:"|09|basicasco|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129272; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain basketballsport.cn"; content:"|0f|basketballsport|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129273; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain basurm.com"; content:"|06|basurm|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129274; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bawtsfkincool.fileave.com"; content:"|0d|bawtsfkincool|07|fileave|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129275; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bbb.fozdegen.com"; content:"|03|bbb|08|fozdegen|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129276; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bbkind.ru"; content:"|06|bbkind|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129277; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bbls.ru"; content:"|04|bbls|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129278; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bequeathooh4.info"; content:"|0c|bequeathooh4|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129279; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bersdf.com"; content:"|06|bersdf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129280; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bertoluchio.net"; content:"|0b|bertoluchio|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129281; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestconcurso.info"; content:"|0c|bestconcurso|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129282; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestsocksshop.ru"; content:"|0d|bestsocksshop|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129283; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestviewbar.com"; content:"|0b|bestviewbar|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129284; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestviewbars.com"; content:"|0c|bestviewbars|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129285; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain biaobrgeroin.cn"; content:"|0c|biaobrgeroin|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129286; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bichalina.cn"; content:"|09|bichalina|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129287; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigamadillo.cn"; content:"|0b|bigamadillo|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129288; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigamadillo.ru"; content:"|0b|bigamadillo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129289; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigeasysite.com"; content:"|0b|bigeasysite|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129290; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigpayinfo.com"; content:"|0a|bigpayinfo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129291; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigpayinfos.com"; content:"|0b|bigpayinfos|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129292; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bits4ever.ru"; content:"|09|bits4ever|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129293; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain biyik.net"; content:"|05|biyik|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129294; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain biznesscom.cn"; content:"|0a|biznesscom|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129295; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain biztoolbar.com"; content:"|0a|biztoolbar|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129296; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bklcm.com"; content:"|05|bklcm|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129297; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bl.fcrazy.cc"; content:"|02|bl|06|fcrazy|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129298; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bl.fcrazy.eu"; content:"|02|bl|06|fcrazy|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129299; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bl.nemeriss.com"; content:"|02|bl|08|nemeriss|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129300; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bl.widget-des.in"; content:"|02|bl|0a|widget-des|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129301; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bl4ckst4r.cn"; content:"|09|bl4ckst4r|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129302; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blackhorce.com"; content:"|0a|blackhorce|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129303; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blacktraf.su"; content:"|09|blacktraf|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129304; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blakoneyrenr.ru"; content:"|0c|blakoneyrenr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129305; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blasphemy774.info"; content:"|0c|blasphemy774|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129306; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blixsearch.tw"; content:"|0a|blixsearch|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129307; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blogjo.biz"; content:"|06|blogjo|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129308; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bluefincafe.com"; content:"|0b|bluefincafe|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129309; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bmw-pad.com"; content:"|07|bmw-pad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129310; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bmwx6here.ru"; content:"|09|bmwx6here|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129311; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bodegazonen.dk"; content:"|0b|bodegazonen|02|dk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129312; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bombomuser.com"; content:"|0a|bombomuser|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129313; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bonokur.ru"; content:"|07|bonokur|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129314; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bookheads.cn"; content:"|09|bookheads|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129315; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain boonz.in"; content:"|05|boonz|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129316; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bootch.in"; content:"|06|bootch|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129317; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain boronbolt.net"; content:"|09|boronbolt|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129318; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain boshbf.ru"; content:"|06|boshbf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129319; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bot.gravityz3ro.com"; content:"|03|bot|0b|gravityz3ro|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129320; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain botnet.gsk2.org"; content:"|06|botnet|04|gsk2|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129321; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain botnet.su"; content:"|06|botnet|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129322; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bpergroup.ru"; content:"|09|bpergroup|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129323; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brclscounter.com"; content:"|0c|brclscounter|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129324; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain briderscapes.info"; content:"|0c|briderscapes|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129325; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain broad9.com"; content:"|06|broad9|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129326; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brocfg.eu"; content:"|06|brocfg|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129327; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brockenmon.cn"; content:"|0a|brockenmon|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129328; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brownconsulting.com.pe"; content:"|0f|brownconsulting|03|com|02|pe"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129329; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brunongino.com"; content:"|0a|brunongino|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129330; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bsnes.biz"; content:"|05|bsnes|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129331; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bubendockader.com"; content:"|0d|bubendockader|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129332; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bulba-serche.cn"; content:"|0c|bulba-serche|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129333; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain buterbrodio.ru"; content:"|0b|buterbrodio|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129334; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bvakjyr.com"; content:"|07|bvakjyr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129335; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain c.rowfirst.com"; content:"|01|c|08|rowfirst|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129336; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain c339.net"; content:"|04|c339|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129337; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain c7.qpdofz.net"; content:"|02|c7|06|qpdofz|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129338; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cacallcentercareers.com"; content:"|13|cacallcentercareers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129339; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cactus.esstu.ru"; content:"|06|cactus|05|esstu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129340; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cahgofoneu.ru"; content:"|0a|cahgofoneu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129341; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cajadomestic.org"; content:"|0c|cajadomestic|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129342; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain caleb.eu5.org"; content:"|05|caleb|03|eu5|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129343; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain calvinkleinstuffz.com"; content:"|11|calvinkleinstuffz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129344; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain caposervice.net"; content:"|0b|caposervice|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129345; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain caramelloinze.net"; content:"|0d|caramelloinze|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129346; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain carbon.allenchaconads.info"; content:"|06|carbon|0e|allenchaconads|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129347; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain carderplanet.me"; content:"|0c|carderplanet|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129348; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain carvertv.com"; content:"|08|carvertv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129349; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain caseoffinance.cc"; content:"|0d|caseoffinance|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129350; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain caucasus-a.com"; content:"|0a|caucasus-a|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129351; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cavemonsterfromhell.net"; content:"|13|cavemonsterfromhell|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129352; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cca.ky"; content:"|03|cca|02|ky"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129353; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain centraldns.ru"; content:"|0a|centraldns|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129354; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain centralspl.ru"; content:"|0a|centralspl|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129355; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain centryfag.com"; content:"|09|centryfag|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129356; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chakra.master-networking.net"; content:"|06|chakra|11|master-networking|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129357; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chamberwellmanor.com"; content:"|10|chamberwellmanor|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129358; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain checkonline-protection.co.uk"; content:"|16|checkonline-protection|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129359; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain checkrapport.com"; content:"|0c|checkrapport|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129360; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cherry.real-host.ru"; content:"|06|cherry|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129361; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cheryy.com"; content:"|06|cheryy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129362; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chetiripolka.com"; content:"|0c|chetiripolka|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129363; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chinamega.net"; content:"|09|chinamega|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129364; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chinaoilfactory.cn"; content:"|0f|chinaoilfactory|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129365; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chispa.nu"; content:"|06|chispa|02|nu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129366; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chlenopopik.com"; content:"|0b|chlenopopik|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129367; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chotnam.net"; content:"|07|chotnam|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129368; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chris25project.cn"; content:"|0e|chris25project|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129369; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chudachok9.ru"; content:"|0a|chudachok9|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129370; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cin-turk.com"; content:"|08|cin-turk|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129371; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cird.ru"; content:"|04|cird|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129372; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ciscocommunity.cn"; content:"|0e|ciscocommunity|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129373; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cleanfile.net"; content:"|09|cleanfile|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129374; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cleanmyos.com"; content:"|09|cleanmyos|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129375; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain click-clicke.com"; content:"|0c|click-clicke|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129376; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain clientsatisfactiononline.net"; content:"|18|clientsatisfactiononline|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129377; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain clonick.no-ip.org"; content:"|07|clonick|05|no-ip|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129378; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cncdatanetwork.cn"; content:"|0e|cncdatanetwork|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129379; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cocainy.biz"; content:"|07|cocainy|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129380; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cocainy.com"; content:"|07|cocainy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129381; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain codrx.runox.ru"; content:"|05|codrx|05|runox|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129382; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain coffeworld.rv.ua"; content:"|0a|coffeworld|02|rv|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129383; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cogs.trfafsegh.com"; content:"|04|cogs|09|trfafsegh|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129384; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain colloquialewfe.info"; content:"|0e|colloquialewfe|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129385; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain colopin.cn"; content:"|07|colopin|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129386; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain computers-services.co.uk"; content:"|12|computers-services|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129387; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain condenadoalsuerte.com"; content:"|11|condenadoalsuerte|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129388; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain condonikzang.info"; content:"|0c|condonikzang|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129389; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain conf23452.cn"; content:"|09|conf23452|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129390; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain conf2552.cn"; content:"|08|conf2552|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129391; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain configchenel.com"; content:"|0c|configchenel|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129392; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain congealagmfd6dbd.info"; content:"|10|congealagmfd6dbd|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129393; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain connectionsupport.org"; content:"|11|connectionsupport|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129394; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain contentserver.ru"; content:"|0d|contentserver|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129395; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain contexstyle.ru"; content:"|0b|contexstyle|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129396; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cool.epicip.info"; content:"|04|cool|06|epicip|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129397; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain coolparts31.tw"; content:"|0b|coolparts31|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129398; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain coolw.in"; content:"|05|coolw|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129399; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain core.pr0fit.net"; content:"|04|core|06|pr0fit|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129400; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cosavnos.ru"; content:"|08|cosavnos|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129401; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain countrtds.ru"; content:"|09|countrtds|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129402; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain countrystar.ru"; content:"|0b|countrystar|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129403; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cquenceclothing.com"; content:"|0f|cquenceclothing|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129404; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain crazzzy.net"; content:"|07|crazzzy|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129405; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain creamwithsodahan.com"; content:"|10|creamwithsodahan|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129406; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain creativeid.com.au"; content:"|0a|creativeid|03|com|02|au"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129407; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain crexes.ru"; content:"|06|crexes|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129408; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain crferari.info"; content:"|08|crferari|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129409; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cribrejist.kz"; content:"|0a|cribrejist|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129410; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain crookwach.com"; content:"|09|crookwach|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129411; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain crowledarmor.com"; content:"|0c|crowledarmor|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129412; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cs-config.org"; content:"|09|cs-config|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129413; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cvvsellz.net"; content:"|08|cvvsellz|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129414; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cybertranceru.ru"; content:"|0d|cybertranceru|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129415; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain d4rkst4r.cn"; content:"|08|d4rkst4r|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129416; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dadadsaaa.wapdodoit.ru"; content:"|09|dadadsaaa|09|wapdodoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129417; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dahzunaeye.ru"; content:"|0a|dahzunaeye|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129418; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dailyair.net"; content:"|08|dailyair|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129419; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dailynews6x24.com"; content:"|0d|dailynews6x24|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129420; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dairanet.cn"; content:"|08|dairanet|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129421; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain darktimes4biz.biz"; content:"|0d|darktimes4biz|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129422; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain darnite.ru"; content:"|07|darnite|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129423; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain darrellflowers.com"; content:"|0e|darrellflowers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129424; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain data0rder.net"; content:"|09|data0rder|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129425; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain datingtipsforman.net"; content:"|10|datingtipsforman|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129426; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain davidopolko.ru"; content:"|0b|davidopolko|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129427; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dbcavsaddve.com"; content:"|0b|dbcavsaddve|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129428; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ddkom.biz"; content:"|05|ddkom|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129429; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain declaracion.bde.es.psdrv.ru"; content:"|0b|declaracion|03|bde|02|es|05|psdrv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129430; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain deewaek4heeh.kz"; content:"|0c|deewaek4heeh|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129431; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dehtrader.com"; content:"|09|dehtrader|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129432; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain deilaeyeew.ru"; content:"|0a|deilaeyeew|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129433; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain delphin.w2c.ru"; content:"|07|delphin|03|w2c|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129434; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain deltoflop.ru"; content:"|09|deltoflop|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129435; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain deluz666.info"; content:"|08|deluz666|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129436; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain demiliawes.com"; content:"|0a|demiliawes|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129437; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain demo1.de"; content:"|05|demo1|02|de"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129438; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain demonvoploti.net"; content:"|0c|demonvoploti|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129439; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dersausko.ru"; content:"|09|dersausko|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129440; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain designtrl.km.ua"; content:"|09|designtrl|02|km|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129441; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain desktop.google.com.3gsuite.net"; content:"|07|desktop|06|google|03|com|07|3gsuite|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129442; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain desktop.google.com.x0x0x0x0x0x0.net"; content:"|07|desktop|06|google|03|com|0c|x0x0x0x0x0x0|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129443; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain develo89.ru"; content:"|08|develo89|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129444; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain devi56.co.cc"; content:"|06|devi56|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129445; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain devicemom.net"; content:"|09|devicemom|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129446; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain deviliz.com"; content:"|07|deviliz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129447; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dewaned.eu"; content:"|07|dewaned|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129448; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dfrgc.cn"; content:"|05|dfrgc|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129449; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dgnews.org"; content:"|06|dgnews|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129450; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dildogold.net"; content:"|09|dildogold|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129451; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dimlerstock.info"; content:"|0b|dimlerstock|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129452; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dir320yota.ru"; content:"|0a|dir320yota|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129453; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain direct-point.com"; content:"|0c|direct-point|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129454; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain directstmpl.info"; content:"|0b|directstmpl|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129455; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain discoverany.cn"; content:"|0b|discoverany|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129456; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain distribway.com"; content:"|0a|distribway|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129457; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain djhbzsv.cn"; content:"|07|djhbzsv|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129458; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain djkksdjfkkldjslkdfj.com"; content:"|13|djkksdjfkkldjslkdfj|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129459; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dledns.org"; content:"|06|dledns|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129460; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dnsserverbackupzones.com"; content:"|14|dnsserverbackupzones|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129461; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dnuos.ru"; content:"|05|dnuos|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129462; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain doctormiler.com"; content:"|0b|doctormiler|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129463; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain doctornimnul.com"; content:"|0c|doctornimnul|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129464; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain doctorscam.net"; content:"|0a|doctorscam|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129465; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dog-deluxe.nl"; content:"|0a|dog-deluxe|02|nl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129466; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain domain460003.com"; content:"|0c|domain460003|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129467; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain donald-dark.net"; content:"|0b|donald-dark|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129468; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain door4.net.ua"; content:"|05|door4|03|net|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129469; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dotroot.su"; content:"|07|dotroot|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129470; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloadmiddle.com"; content:"|0e|downloadmiddle|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129471; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloads.mediaoff-0011.com"; content:"|09|downloads|0d|mediaoff-0011|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129472; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloads.mediaoff-005.com"; content:"|09|downloads|0c|mediaoff-005|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129473; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloads.pixhome-007.com"; content:"|09|downloads|0b|pixhome-007|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129474; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloads.pixhome-009.com"; content:"|09|downloads|0b|pixhome-009|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129475; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloads.pixhome-014.net"; content:"|09|downloads|0b|pixhome-014|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129476; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain downloads.pixhome-018.net"; content:"|09|downloads|0b|pixhome-018|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129477; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dowsonstoke.cc"; content:"|0b|dowsonstoke|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129478; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dragelike.jino.ru"; content:"|09|dragelike|04|jino|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129479; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dresnennewsllc.com"; content:"|0e|dresnennewsllc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129480; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain driver-cs.real-host.ru"; content:"|09|driver-cs|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129481; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain driverupdateter.cn"; content:"|0f|driverupdateter|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129482; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain drtyyyt.ru"; content:"|07|drtyyyt|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129483; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain drygy.mooo.com"; content:"|05|drygy|04|mooo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129484; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ds.xdns.eu"; content:"|02|ds|04|xdns|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129485; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dsgfopllllc.com"; content:"|0b|dsgfopllllc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129486; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain duribi.com"; content:"|06|duribi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129487; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dzinternet.co.cc"; content:"|0a|dzinternet|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129488; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eagen85.net"; content:"|07|eagen85|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129489; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain easytest4us.com.tw"; content:"|0b|easytest4us|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129490; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eatmyshortsforever.info"; content:"|12|eatmyshortsforever|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129491; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ecologiauto.com"; content:"|0b|ecologiauto|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129492; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ectoplan.net"; content:"|08|ectoplan|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129493; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain edatingtipsandtricks.com"; content:"|14|edatingtipsandtricks|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129494; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eemaimocho.ru"; content:"|0a|eemaimocho|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129495; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eexiziedai.ru"; content:"|0a|eexiziedai|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129496; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ekuns.com"; content:"|05|ekuns|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129497; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain elesssnet.net"; content:"|09|elesssnet|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129498; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ellater.com"; content:"|07|ellater|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129499; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ellynoise.com"; content:"|09|ellynoise|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129500; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain elnasa.ru"; content:"|06|elnasa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129501; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain enoraup.com"; content:"|07|enoraup|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129502; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain enzoforfree.ru"; content:"|0b|enzoforfree|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129503; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ergota.com"; content:"|06|ergota|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129504; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain erorr.net"; content:"|05|erorr|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129505; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain erotic4gals.com"; content:"|0b|erotic4gals|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129506; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ertopolk.ru"; content:"|08|ertopolk|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129507; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esero86.ru"; content:"|07|esero86|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129508; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain estero89.ru"; content:"|08|estero89|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129509; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esvictory1.ru"; content:"|0a|esvictory1|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129510; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esvictory5.ru"; content:"|0a|esvictory5|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129511; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esvr1.ru"; content:"|05|esvr1|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129512; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esvr2.com"; content:"|05|esvr2|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129513; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esvr3.ru"; content:"|05|esvr3|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129514; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain etyet.name"; content:"|05|etyet|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129515; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eurelectrics.com"; content:"|0c|eurelectrics|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129516; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain euro-transp.ru"; content:"|0b|euro-transp|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129517; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain euroassistant.eu"; content:"|0d|euroassistant|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129518; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain evgonar.1gb.ru"; content:"|07|evgonar|03|1gb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129519; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain evqwt.ru"; content:"|05|evqwt|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129520; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain evrorem2010.real-host.ru"; content:"|0b|evrorem2010|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129521; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain evvke.ru"; content:"|05|evvke|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129522; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ewwinvvnwieoncnuurnvn.com"; content:"|15|ewwinvvnwieoncnuurnvn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129523; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain excel-biz.net"; content:"|09|excel-biz|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129524; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain excode.info"; content:"|06|excode|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129525; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain exfxreporting.com"; content:"|0d|exfxreporting|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129526; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain exhouse400doors.com"; content:"|0f|exhouse400doors|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129527; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain extrim.jr1.ru"; content:"|06|extrim|03|jr1|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129528; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain f3411ssgas.cn"; content:"|0a|f3411ssgas|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129529; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fabrika.uzhgorod.ua"; content:"|07|fabrika|08|uzhgorod|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129530; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fajopalos.com"; content:"|09|fajopalos|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129531; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fancycake.net"; content:"|09|fancycake|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129532; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain farfa.ru"; content:"|05|farfa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129533; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain farsearch.tw"; content:"|09|farsearch|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129534; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fart2074.net"; content:"|08|fart2074|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129535; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain farwest.cn"; content:"|07|farwest|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129536; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fcrazy.eu"; content:"|06|fcrazy|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129537; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fdlnpnldnssnlaksjdljksasdad.com"; content:"|1b|fdlnpnldnssnlaksjdljksasdad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129538; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fdsfs.wapdodoit.ru"; content:"|05|fdsfs|09|wapdodoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129539; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain feit23.com"; content:"|06|feit23|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129540; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fel0ny.com"; content:"|06|fel0ny|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129541; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ferdinandi.ru"; content:"|0a|ferdinandi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129542; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fest.snadder.org"; content:"|04|fest|07|snadder|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129543; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ffadd.ru"; content:"|05|ffadd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129544; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fgdimage77.com"; content:"|0a|fgdimage77|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129545; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fhjslk21.com.tw"; content:"|08|fhjslk21|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129546; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fiducia-securitygate.com"; content:"|14|fiducia-securitygate|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129547; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain files-online.ru"; content:"|0c|files-online|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129548; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain findyourkin.cn"; content:"|0b|findyourkin|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129549; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain finlinkonline.com"; content:"|0d|finlinkonline|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129550; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain first-shockabsorbers.com"; content:"|14|first-shockabsorbers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129551; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fiusdfss.wapdodoit.ru"; content:"|08|fiusdfss|09|wapdodoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129552; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fivefingers31.org"; content:"|0d|fivefingers31|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129553; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fiwzv.net"; content:"|05|fiwzv|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129554; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fixerman.cn"; content:"|08|fixerman|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129555; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain flamefight.com"; content:"|0a|flamefight|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129556; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain flashsecurity.ru"; content:"|0d|flashsecurity|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129557; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain flexinstaller.org.uk"; content:"|0d|flexinstaller|03|org|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129558; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain flf.kz"; content:"|03|flf|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129559; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain floranimal.ru"; content:"|0a|floranimal|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129560; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fooofle.ru"; content:"|07|fooofle|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129561; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain forad.cz"; content:"|05|forad|02|cz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129562; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fordearfriends.com"; content:"|0e|fordearfriends|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129563; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain foreks999.ru"; content:"|09|foreks999|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129564; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain forexcenterhome.com"; content:"|0f|forexcenterhome|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129565; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain forskarskolan.se"; content:"|0d|forskarskolan|02|se"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129566; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fortoooco.su"; content:"|09|fortoooco|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129567; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fotosbasesite.info"; content:"|0d|fotosbasesite|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129568; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain foxy10000.cn"; content:"|09|foxy10000|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129569; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fpcc.biz"; content:"|04|fpcc|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129570; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain freehost21.tw"; content:"|0a|freehost21|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129571; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain freewhois.ru"; content:"|09|freewhois|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129572; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain friendship888.cn"; content:"|0d|friendship888|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129573; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain friendsparty.org"; content:"|0c|friendsparty|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129574; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain from-us-with-love.com"; content:"|11|from-us-with-love|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129575; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain frondircass.cn"; content:"|0b|frondircass|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129576; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fsdfsdfsd.co.uk"; content:"|09|fsdfsdfsd|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129577; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain futurexstream.com"; content:"|0d|futurexstream|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129578; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain g00glee.cn"; content:"|07|g00glee|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129579; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain g3vrv3rveverfsd.tw"; content:"|0f|g3vrv3rveverfsd|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129580; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gabesflowers.co.cc"; content:"|0c|gabesflowers|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129581; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gaddem.org"; content:"|06|gaddem|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129582; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain galaradio.name"; content:"|09|galaradio|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129583; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gamecp12.cn"; content:"|08|gamecp12|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129584; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gametester.ru"; content:"|0a|gametester|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129585; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain garant.ir"; content:"|06|garant|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129586; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain garant.ivano-frankivsk.ua"; content:"|06|garant|0f|ivano-frankivsk|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129587; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gate234.cn"; content:"|07|gate234|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129588; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gaubine-forwodore.cn"; content:"|11|gaubine-forwodore|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129589; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gavnoedov.net"; content:"|09|gavnoedov|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129590; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gaxnet32.com"; content:"|08|gaxnet32|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129591; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gb100skdahsdyg.com"; content:"|0e|gb100skdahsdyg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129592; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain geekspoker.net"; content:"|0a|geekspoker|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129593; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain geleiance.com"; content:"|09|geleiance|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129594; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain genderswar.co.cc"; content:"|0a|genderswar|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129595; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain genie-hkfc.com"; content:"|0a|genie-hkfc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129596; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain genri.cz.cc"; content:"|05|genri|02|cz|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129597; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain germinaler4he.info"; content:"|0d|germinaler4he|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129598; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain geroinanety.net"; content:"|0b|geroinanety|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129599; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain geroine.biz"; content:"|07|geroine|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129600; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gerst66.com"; content:"|07|gerst66|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129601; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gfdplaytennisron.mobi"; content:"|10|gfdplaytennisron|04|mobi"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129602; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ggooggle.net"; content:"|08|ggooggle|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129603; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ghyas.ru"; content:"|05|ghyas|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129604; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gibderv.ru"; content:"|07|gibderv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129605; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gigapayfosus.com"; content:"|0c|gigapayfosus|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129606; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gilsenkirhen.at"; content:"|0c|gilsenkirhen|02|at"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129607; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gipnogaba777.name"; content:"|0c|gipnogaba777|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129608; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain globalreceive.info"; content:"|0d|globalreceive|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129609; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain globalunitrack.net"; content:"|0e|globalunitrack|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129610; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain globus-trio.ru"; content:"|0b|globus-trio|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129611; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gm1online.com"; content:"|09|gm1online|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129612; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain goawatanitooo.eu"; content:"|0d|goawatanitooo|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129613; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gobishertech.net"; content:"|0c|gobishertech|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129614; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gointernetdating.com"; content:"|10|gointernetdating|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129615; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain goldfieldforu.cc"; content:"|0d|goldfieldforu|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129616; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gonoristan.cn"; content:"|0a|gonoristan|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129617; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gooddatingadvice.net"; content:"|10|gooddatingadvice|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129618; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain googie-update.com"; content:"|0d|googie-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129619; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-analyze.ru"; content:"|0e|google-analyze|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129620; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-bot.info"; content:"|0a|google-bot|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129621; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-counter.co.cc"; content:"|0e|google-counter|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129622; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-diric.com"; content:"|0c|google-diric|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129623; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-stats.ru"; content:"|0c|google-stats|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129624; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-stats008.cn"; content:"|0f|google-stats008|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129625; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google-update-checker.cn"; content:"|15|google-update-checker|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129626; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain google223.ru"; content:"|09|google223|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129627; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain googleadsenstats.ru"; content:"|10|googleadsenstats|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129628; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain googleanalisys.net"; content:"|0e|googleanalisys|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129629; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain googleenginierung.net"; content:"|11|googleenginierung|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129630; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain googletracker.info"; content:"|0d|googletracker|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129631; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gopuz.com"; content:"|05|gopuz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129632; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gorliante.com"; content:"|09|gorliante|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129633; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain governmentfunding.eu"; content:"|11|governmentfunding|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129634; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gpt0.ru"; content:"|04|gpt0|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129635; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain granata282.cn"; content:"|0a|granata282|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129636; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greatan.cn"; content:"|07|greatan|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129637; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greatuk.org"; content:"|07|greatuk|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129638; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gredserop.com"; content:"|09|gredserop|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129639; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greengirlinbighome.ru"; content:"|12|greengirlinbighome|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129640; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greenhead.cn"; content:"|09|greenhead|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129641; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greenline.cv.ua"; content:"|09|greenline|02|cv|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129642; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain grefprostat.info"; content:"|0b|grefprostat|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129643; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gregariouszy.info"; content:"|0c|gregariouszy|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129644; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain grigga-sinna.com"; content:"|0c|grigga-sinna|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129645; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain groov.uzhgorod.ua"; content:"|05|groov|08|uzhgorod|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129646; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gtrb.ru"; content:"|04|gtrb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129647; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gtrfz.biz"; content:"|05|gtrfz|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129648; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain guahslq.ru"; content:"|07|guahslq|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129649; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hack-off.ru"; content:"|08|hack-off|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129650; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hackfact.co.za"; content:"|08|hackfact|02|co|02|za"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129651; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hackingnation.org"; content:"|0d|hackingnation|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129652; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hallownets.cn"; content:"|0a|hallownets|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129653; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hamilakinec.eu"; content:"|0b|hamilakinec|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129654; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain happykinder.org"; content:"|0b|happykinder|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129655; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain happyworld0nline.biz"; content:"|10|happyworld0nline|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129656; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain haretere.biz"; content:"|08|haretere|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129657; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain harflash.cn"; content:"|08|harflash|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129658; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hasgsa.com"; content:"|06|hasgsa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129659; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hassled.info"; content:"|07|hassled|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129660; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain havethe.cc"; content:"|07|havethe|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129661; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hazelpay.ru"; content:"|08|hazelpay|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129662; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hcardoso.com"; content:"|08|hcardoso|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129663; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain heisthat.biz"; content:"|08|heisthat|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129664; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hellokittyn.tw"; content:"|0b|hellokittyn|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129665; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hellzoness.ru"; content:"|0a|hellzoness|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129666; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain helmihelmi.com"; content:"|0a|helmihelmi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129667; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain helsint.ru"; content:"|07|helsint|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129668; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain herewereytinj.com"; content:"|0d|herewereytinj|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129669; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain heroladaaw.biz"; content:"|0a|heroladaaw|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129670; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain herserton.ru"; content:"|09|herserton|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129671; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain heskdo44se.com"; content:"|0a|heskdo44se|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129672; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hhjjqjghfir.com"; content:"|0b|hhjjqjghfir|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129673; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hibernawar.com"; content:"|0a|hibernawar|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129674; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hiddenowned.viefirehosting.com"; content:"|0b|hiddenowned|0e|viefirehosting|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129675; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hihohy.com"; content:"|06|hihohy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129676; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hikmesanbukais.com"; content:"|0e|hikmesanbukais|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129677; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hilary-blog.net"; content:"|0b|hilary-blog|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129678; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hilaryblog.x10.bz"; content:"|0a|hilaryblog|03|x10|02|bz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129679; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hiphopniger.com"; content:"|0b|hiphopniger|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129680; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain histerpryne.biz"; content:"|0b|histerpryne|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129681; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain history03kf.com"; content:"|0b|history03kf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129682; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain historycontext.cn"; content:"|0e|historycontext|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129683; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hjelp-haiti.org"; content:"|0b|hjelp-haiti|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129684; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hkisl.com.cn"; content:"|05|hkisl|03|com|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129685; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain homeschoolvideo.net"; content:"|0f|homeschoolvideo|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129686; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hometelecaring.net"; content:"|0e|hometelecaring|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129687; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain homyak777.cn"; content:"|09|homyak777|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129688; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain horonili.ru"; content:"|08|horonili|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129689; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain horosta.ru"; content:"|07|horosta|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129690; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain horosta1.ru"; content:"|08|horosta1|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129691; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain host-data.com"; content:"|09|host-data|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129692; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hostingpanelavg.com"; content:"|0f|hostingpanelavg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129693; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hostz-150909.com"; content:"|0c|hostz-150909|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129694; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hotdot2561.com"; content:"|0a|hotdot2561|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129695; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hottravels.cn"; content:"|0a|hottravels|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129696; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hozeisland.ru"; content:"|0a|hozeisland|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129697; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hqcqyqlktsg.com"; content:"|0b|hqcqyqlktsg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129698; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hqll.ru"; content:"|04|hqll|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129699; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hronumers.com"; content:"|09|hronumers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129700; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hsaaba.com"; content:"|06|hsaaba|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129701; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hsbc-trial.cn"; content:"|0a|hsbc-trial|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129702; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hsbc-trial.co.uk"; content:"|0a|hsbc-trial|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129703; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hsbc-trial.net"; content:"|0a|hsbc-trial|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129704; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain huaas.com"; content:"|05|huaas|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129705; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain huashna.com"; content:"|07|huashna|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129706; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hub-z.net"; content:"|05|hub-z|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129707; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hubportalzone.com"; content:"|0d|hubportalzone|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129708; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hufndas.ru"; content:"|07|hufndas|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129709; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hulasoftz.cn"; content:"|09|hulasoftz|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129710; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hulinadobaranublja.com"; content:"|12|hulinadobaranublja|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129711; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hydrateam.cn"; content:"|09|hydrateam|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129712; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hzo4em.vn.ua"; content:"|06|hzo4em|02|vn|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129713; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iam.superfluxed.net"; content:"|03|iam|0b|superfluxed|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129714; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iaoa.ru"; content:"|04|iaoa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129715; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain icelemon.net"; content:"|08|icelemon|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129716; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ieexv.com"; content:"|05|ieexv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129717; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iefeiyusahgaineeveikooth.com"; content:"|18|iefeiyusahgaineeveikooth|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129718; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ielaithereej.ru"; content:"|0c|ielaithereej|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129719; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iesahnaepi.ru"; content:"|0a|iesahnaepi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129720; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iescrow.ir"; content:"|07|iescrow|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129721; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ieweepeeve.ru"; content:"|0a|ieweepeeve|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129722; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iffer.asia"; content:"|05|iffer|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129723; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iframecash.net"; content:"|0a|iframecash|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129724; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain igetth.cn"; content:"|06|igetth|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129725; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iijae.ru"; content:"|05|iijae|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129726; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ijll.ru"; content:"|04|ijll|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129727; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ili-lala-ili.com"; content:"|0c|ili-lala-ili|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129728; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iliil.ru"; content:"|05|iliil|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129729; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain imageaseea.com"; content:"|0a|imageaseea|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129730; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain imbiurbiej.com"; content:"|0a|imbiurbiej|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129731; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain img4453945.com"; content:"|0a|img4453945|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129732; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain incode.name"; content:"|06|incode|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129733; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain incornew.net"; content:"|08|incornew|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129734; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain indigo49.biz"; content:"|08|indigo49|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129735; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain infinitccoopp.cn"; content:"|0d|infinitccoopp|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129736; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain info-news.name"; content:"|09|info-news|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129737; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain inhaber-moack.com"; content:"|0d|inhaber-moack|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129738; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain inkognittto.ru"; content:"|0b|inkognittto|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129739; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain instamfan.net"; content:"|09|instamfan|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129740; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain interhostingservicesnet.com"; content:"|17|interhostingservicesnet|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129741; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain internazionale.vc"; content:"|0e|internazionale|02|vc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129742; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain inversiontrace.ru"; content:"|0e|inversiontrace|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129743; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iooiiooi.cn"; content:"|08|iooiiooi|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129744; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iphotos.ir"; content:"|07|iphotos|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129745; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ipnatstats.com"; content:"|0a|ipnatstats|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129746; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iprivate.info"; content:"|08|iprivate|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129747; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iproxy.nl"; content:"|06|iproxy|02|nl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129748; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ipv6i.tw"; content:"|05|ipv6i|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129749; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ipvi6.tw"; content:"|05|ipvi6|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129750; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain irc.superbits.net"; content:"|03|irc|09|superbits|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129751; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iron-words.info"; content:"|0a|iron-words|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129752; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain irrationalsdv3.info"; content:"|0e|irrationalsdv3|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129753; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain islamatease.com"; content:"|0b|islamatease|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129754; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain issimode.net"; content:"|08|issimode|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129755; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain itspitsp.com"; content:"|08|itspitsp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129756; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain itsupportworld.com"; content:"|0e|itsupportworld|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129757; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ivanyi.homeip.net"; content:"|06|ivanyi|06|homeip|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129758; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iveeteepew.ru"; content:"|0a|iveeteepew|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129759; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iwantr8.ru"; content:"|07|iwantr8|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129760; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain IWfybFyWi.com"; content:"|09|IWfybFyWi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129761; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iyahoo.me"; content:"|06|iyahoo|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129762; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain izdibabu.ru"; content:"|08|izdibabu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129763; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain j2c-crib.com"; content:"|08|j2c-crib|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129764; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jacquelinesiven.com"; content:"|0f|jacquelinesiven|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129765; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jamesbeach.com"; content:"|0a|jamesbeach|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129766; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jessw.info"; content:"|05|jessw|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129767; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jfgh.ru"; content:"|04|jfgh|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129768; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jisver.ru"; content:"|06|jisver|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129769; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jjaa.ru"; content:"|04|jjaa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129770; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jjlb.ru"; content:"|04|jjlb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129771; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jjll.ru"; content:"|04|jjll|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129772; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jjol.ru"; content:"|04|jjol|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129773; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jk100asdsadhg.com"; content:"|0d|jk100asdsadhg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129774; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain joanglobus.com"; content:"|0a|joanglobus|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129775; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jocudaidie.ru"; content:"|0a|jocudaidie|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129776; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain johgheejae.ru"; content:"|0a|johgheejae|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129777; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain johnm.tmweb.ru"; content:"|05|johnm|05|tmweb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129778; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jokersimson.net"; content:"|0b|jokersimson|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129779; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain joysmovie.org"; content:"|09|joysmovie|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129780; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain judiciousr347.info"; content:"|0d|judiciousr347|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129781; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain juicypussyy.ru"; content:"|0b|juicypussyy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129782; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jupitermotors.com.au"; content:"|0d|jupitermotors|03|com|02|au"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129783; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain justinnew4.com"; content:"|0a|justinnew4|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129784; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain justinnew5.com"; content:"|0a|justinnew5|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129785; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain justinnew6.com"; content:"|0a|justinnew6|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129786; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain justpaythis.cn"; content:"|0b|justpaythis|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129787; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kabinaout.net"; content:"|09|kabinaout|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129788; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kaithuushi.ru"; content:"|0a|kaithuushi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129789; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kalashmalash.org"; content:"|0c|kalashmalash|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129790; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kalib.eu5.org"; content:"|05|kalib|03|eu5|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129791; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kannat.biz"; content:"|06|kannat|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129792; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain karenearly.com"; content:"|0a|karenearly|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129793; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain karissmikksa.com"; content:"|0c|karissmikksa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129794; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain karma.collection.pk"; content:"|05|karma|0a|collection|02|pk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129795; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kashamalasha.net"; content:"|0c|kashamalasha|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129796; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kassvikiss.com"; content:"|0a|kassvikiss|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129797; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kasszeukiss.com"; content:"|0b|kasszeukiss|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129798; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kazyvi.net"; content:"|06|kazyvi|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129799; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kebopof.com"; content:"|07|kebopof|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129800; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain keholope.cn"; content:"|08|keholope|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129801; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain keiboghigi.ru"; content:"|0a|keiboghigi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129802; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kelandiciv.net"; content:"|0a|kelandiciv|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129803; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kennywest.mooo.com"; content:"|09|kennywest|04|mooo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129804; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain keroholek.net"; content:"|09|keroholek|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129805; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kindsms.com"; content:"|07|kindsms|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129806; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kiniop.cn"; content:"|06|kiniop|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129807; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kino.vitk.net"; content:"|04|kino|04|vitk|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129808; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kjjm.biz"; content:"|04|kjjm|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129809; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kkads.ru"; content:"|05|kkads|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129810; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain klajj.ru"; content:"|05|klajj|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129811; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain klastf.ru"; content:"|06|klastf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129812; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain knifes4you.com"; content:"|0a|knifes4you|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129813; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kokaine.biz"; content:"|07|kokaine|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129814; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain koloderber.com"; content:"|0a|koloderber|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129815; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kopibara.km.ua"; content:"|08|kopibara|02|km|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129816; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain korkd.ru"; content:"|05|korkd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129817; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain koshki.hostok.org"; content:"|06|koshki|06|hostok|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129818; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kosimbabkinaletu.biz"; content:"|10|kosimbabkinaletu|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129819; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain krassoffki.com"; content:"|0a|krassoffki|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129820; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kretanlkam.biz"; content:"|0a|kretanlkam|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129821; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kripakripchampion.ru"; content:"|11|kripakripchampion|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129822; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ks357429.kimsufi.com"; content:"|08|ks357429|07|kimsufi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129823; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ksakksik.cn"; content:"|08|ksakksik|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129824; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kspaibu1nasnfx87.com"; content:"|10|kspaibu1nasnfx87|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129825; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kukushata.com"; content:"|09|kukushata|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129826; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kursovie.org.ru"; content:"|08|kursovie|03|org|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129827; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kurupt.cc"; content:"|06|kurupt|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129828; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain l1nn.info"; content:"|04|l1nn|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129829; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lab-sport.cn"; content:"|09|lab-sport|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129830; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lac3w8bu.net"; content:"|08|lac3w8bu|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129831; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lake777.homeip.net"; content:"|07|lake777|06|homeip|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129832; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lalocationmanager.com"; content:"|11|lalocationmanager|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129833; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lampstage.in"; content:"|09|lampstage|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129834; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lanuevaeradeldesarrollo.com"; content:"|17|lanuevaeradeldesarrollo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129835; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lavandos8.cn"; content:"|09|lavandos8|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129836; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain laxahngeezoh.com"; content:"|0c|laxahngeezoh|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129837; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain leadingcase.cc"; content:"|0b|leadingcase|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129838; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain leeds-consulting.com"; content:"|10|leeds-consulting|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129839; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain leeitpobbod.ru"; content:"|0b|leeitpobbod|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129840; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lefamefilmacusto.com"; content:"|10|lefamefilmacusto|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129841; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain leninvgorkax.net"; content:"|0c|leninvgorkax|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129842; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain leyew.info"; content:"|05|leyew|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129843; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lightobmen.ru"; content:"|0a|lightobmen|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129844; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lilia.jino.ru"; content:"|05|lilia|04|jino|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129845; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lingartstorage.com"; content:"|0e|lingartstorage|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129846; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain linmaoshuiqing.cn"; content:"|0e|linmaoshuiqing|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129847; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lisaspers.com"; content:"|09|lisaspers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129848; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain listwowgame.com"; content:"|0b|listwowgame|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129849; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain liswegwegwegu.com"; content:"|0d|liswegwegwegu|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129850; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain litsed.cn"; content:"|06|litsed|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129851; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain liturile.ru"; content:"|08|liturile|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129852; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain liventsov.ru"; content:"|09|liventsov|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129853; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain livetrust.info"; content:"|09|livetrust|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129854; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lkda.info"; content:"|04|lkda|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129855; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lkem.info"; content:"|04|lkem|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129856; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain llllllllllllllllll.net"; content:"|12|llllllllllllllllll|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129857; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lolofam.ru"; content:"|07|lolofam|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129858; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain loloohuildifsd.ru"; content:"|0e|loloohuildifsd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129859; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lometr.pl"; content:"|06|lometr|02|pl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129860; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lonleycin.cn"; content:"|09|lonleycin|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129861; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lonngren.co.uk"; content:"|08|lonngren|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129862; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lopokerasandco.hk"; content:"|0e|lopokerasandco|02|hk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129863; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lovelaser.co.uk"; content:"|09|lovelaser|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129864; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lovesca.info"; content:"|07|lovesca|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129865; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain luckyhostgf.ru"; content:"|0b|luckyhostgf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129866; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain luinstra-vt.nl"; content:"|0b|luinstra-vt|02|nl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129867; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lumibonu.su"; content:"|08|lumibonu|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129868; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain m19citizen.cn"; content:"|0a|m19citizen|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129869; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain m4st3r.info"; content:"|06|m4st3r|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129870; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ma456.ru"; content:"|05|ma456|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129871; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maccrack.ru"; content:"|08|maccrack|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129872; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain macuysinstall.net"; content:"|0d|macuysinstall|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129873; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain madcmx.mx"; content:"|06|madcmx|02|mx"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129874; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maddogidogi.com"; content:"|0b|maddogidogi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129875; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maddogidogi222.com"; content:"|0e|maddogidogi222|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129876; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mafisiengo.ru"; content:"|0a|mafisiengo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129877; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maglavais.ath.cx"; content:"|09|maglavais|03|ath|02|cx"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129878; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain makeadifference.be"; content:"|0f|makeadifference|02|be"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129879; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain malbobro.org"; content:"|08|malbobro|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129880; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mamama.aa.am"; content:"|06|mamama|02|aa|02|am"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129881; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain marketingsmoney.cn"; content:"|0f|marketingsmoney|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129882; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain martyxa.real-host.ru"; content:"|07|martyxa|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129883; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain massive-dynamic.ru"; content:"|0f|massive-dynamic|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129884; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mathematics2u.co.cc"; content:"|0d|mathematics2u|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129885; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maxel-vuds.com"; content:"|0a|maxel-vuds|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129886; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maybelaterornot.com"; content:"|0f|maybelaterornot|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129887; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mazavaza.co.uk"; content:"|08|mazavaza|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129888; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mazavaza0087.com"; content:"|0c|mazavaza0087|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129889; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mcafee-registry.ru"; content:"|0f|mcafee-registry|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129890; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mcdwhbvmthr.com"; content:"|0b|mcdwhbvmthr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129891; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mclaugn.ru"; content:"|07|mclaugn|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129892; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain media1960.ru"; content:"|09|media1960|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129893; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain media76.pabumatrekurik.com"; content:"|07|media76|0e|pabumatrekurik|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129894; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain medriop56.ru"; content:"|09|medriop56|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129895; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain megatuz.ru"; content:"|07|megatuz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129896; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain menu.mcdir.ru"; content:"|04|menu|05|mcdir|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129897; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain meowtent.com"; content:"|08|meowtent|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129898; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mercadoabc.com.br"; content:"|0a|mercadoabc|03|com|02|br"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129899; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain messorg.com"; content:"|07|messorg|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129900; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mfkt.info"; content:"|04|mfkt|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129901; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mgekohii.cn"; content:"|08|mgekohii|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129902; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mh-2.gnet.ba"; content:"|04|mh-2|04|gnet|02|ba"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129903; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-iexplorer8-update.com"; content:"|1b|microsoft-iexplorer8-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129904; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-server4-update.com"; content:"|18|microsoft-server4-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129905; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-update.name"; content:"|10|microsoft-update|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129906; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-updates.co.cc"; content:"|11|microsoft-updates|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129907; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-vista-update.com"; content:"|16|microsoft-vista-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129908; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-windowsxp-update.com"; content:"|1a|microsoft-windowsxp-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129909; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-xp-update.com"; content:"|13|microsoft-xp-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129910; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain milzvortex.info"; content:"|0a|milzvortex|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129911; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mir-krossover.com"; content:"|0d|mir-krossover|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129912; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mitroger.cn"; content:"|08|mitroger|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129913; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mjef.info"; content:"|04|mjef|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129914; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mmjl3l45lkjbdb.ru"; content:"|0e|mmjl3l45lkjbdb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129915; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mmnba.ru"; content:"|05|mmnba|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129916; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mmoworlds.cn"; content:"|09|mmoworlds|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129917; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mnobabla.ru"; content:"|08|mnobabla|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129918; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mohname333.ru"; content:"|0a|mohname333|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129919; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain molniy347.com"; content:"|09|molniy347|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129920; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain montaz.gr"; content:"|06|montaz|02|gr"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129921; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mooshooh.info"; content:"|08|mooshooh|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129922; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain morda99.ru"; content:"|07|morda99|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129923; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mordes.su"; content:"|06|mordes|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129924; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain movngs.cn"; content:"|06|movngs|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129925; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mroblom.ru"; content:"|07|mroblom|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129926; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mrx.net.ru"; content:"|03|mrx|03|net|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129927; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain msupdatescheck.org"; content:"|0e|msupdatescheck|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129928; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain muchomucho.net"; content:"|0a|muchomucho|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129929; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mustangviper.com"; content:"|0c|mustangviper|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129930; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain my-oyster.cn"; content:"|09|my-oyster|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129931; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mydailymail.cn"; content:"|0b|mydailymail|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129932; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mygsm-spy.ru"; content:"|09|mygsm-spy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129933; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mynameisboxxy.com"; content:"|0d|mynameisboxxy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129934; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mypc-services10.com"; content:"|0f|mypc-services10|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129935; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain myperfection.ru"; content:"|0c|myperfection|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129936; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain myphpsoft.cn"; content:"|09|myphpsoft|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129937; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mystaticdatas.ru"; content:"|0d|mystaticdatas|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129938; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mysticfamiliar.com"; content:"|0e|mysticfamiliar|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129939; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mywebsource.ru"; content:"|0b|mywebsource|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129940; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nadvet.su"; content:"|06|nadvet|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129941; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain napznet.me"; content:"|07|napznet|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129942; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain napzter13.net"; content:"|09|napzter13|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129943; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain narayanjik.hk"; content:"|0a|narayanjik|02|hk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129944; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nascetur.com"; content:"|08|nascetur|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129945; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain naukograda.net"; content:"|0a|naukograda|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129946; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain navigable446.info"; content:"|0c|navigable446|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129947; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ncccnnnc.cn"; content:"|08|ncccnnnc|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129948; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nebwsy.com"; content:"|06|nebwsy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129949; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nekovo.ru"; content:"|06|nekovo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129950; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nelmafirstusa.com"; content:"|0d|nelmafirstusa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129951; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nemohuildifsd.ru"; content:"|0d|nemohuildifsd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129952; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nemohuildiin.ru"; content:"|0c|nemohuildiin|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129953; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nerow.org"; content:"|05|nerow|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129954; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain net.lovealiy.com"; content:"|03|net|08|lovealiy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129955; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain net.staedew.com"; content:"|03|net|07|staedew|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129956; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netcarfind.cn"; content:"|0a|netcarfind|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129957; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netornotin.com"; content:"|0a|netornotin|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129958; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain networksolutions5.net"; content:"|11|networksolutions5|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129959; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain neuromint.bz"; content:"|09|neuromint|02|bz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129960; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nevereversite.ru"; content:"|0d|nevereversite|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129961; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain newbraga.cn"; content:"|08|newbraga|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129962; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain newconcurso.info"; content:"|0b|newconcurso|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129963; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain newrus.su"; content:"|06|newrus|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129964; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain newsbosnia.org"; content:"|0a|newsbosnia|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129965; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nextpics.org"; content:"|08|nextpics|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129966; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nfruhskhfts.com"; content:"|0b|nfruhskhfts|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129967; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nicefilmsa.ru"; content:"|0a|nicefilmsa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129968; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain niposedas.ru"; content:"|09|niposedas|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129969; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nisol.ru"; content:"|05|nisol|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129970; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nissanmoto.ru"; content:"|0a|nissanmoto|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129971; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nnam.ru"; content:"|04|nnam|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129972; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nnee.info"; content:"|04|nnee|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129973; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain noabuseplease.cn"; content:"|0d|noabuseplease|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129974; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain noprtus.ru"; content:"|07|noprtus|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129975; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nordrilskre.com"; content:"|0b|nordrilskre|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129976; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nospam.km.ua"; content:"|06|nospam|02|km|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129977; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nsboxdownblodmids.com"; content:"|11|nsboxdownblodmids|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129978; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nsirgey.net"; content:"|07|nsirgey|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129979; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nudlkasnuls.com"; content:"|0b|nudlkasnuls|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129980; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nukaszqz.net"; content:"|08|nukaszqz|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129981; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nuzi.com.cn"; content:"|04|nuzi|03|com|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129982; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nvffr.ru"; content:"|05|nvffr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129983; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oashae2ieyek.ru"; content:"|0c|oashae2ieyek|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129984; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain odboe.info"; content:"|05|odboe|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129985; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ofruv.com"; content:"|05|ofruv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129986; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ogagarin.com"; content:"|08|ogagarin|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129987; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ohmaebahsh.ru"; content:"|0a|ohmaebahsh|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129988; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ohphahfech.ru"; content:"|0a|ohphahfech|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129989; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oiav84.ru"; content:"|06|oiav84|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129990; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain okrison.com"; content:"|07|okrison|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129991; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain olandik.net"; content:"|07|olandik|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129992; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oldcarsforrent.com"; content:"|0e|oldcarsforrent|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129993; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oliku.ru"; content:"|05|oliku|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129994; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain on-line-analytics.org"; content:"|11|on-line-analytics|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129995; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlinecentralstore.com"; content:"|12|onlinecentralstore|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129996; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlinegazik.name"; content:"|0b|onlinegazik|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129997; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlinelicensechecker.ru"; content:"|14|onlinelicensechecker|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129998; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlinestik.in"; content:"|0a|onlinestik|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129999; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlinewebcenter.com"; content:"|0f|onlinewebcenter|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130000; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlynet.bnetinvaderz.com"; content:"|07|onlynet|0c|bnetinvaderz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130001; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oomseekerss.ru"; content:"|0b|oomseekerss|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130002; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ootaivilei.ru"; content:"|0a|ootaivilei|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130003; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain openslp.co.cc"; content:"|07|openslp|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130004; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ophaeghaev.ru"; content:"|0a|ophaeghaev|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130005; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain opllllc.com"; content:"|07|opllllc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130006; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oracleoledb.cn"; content:"|0b|oracleoledb|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130007; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain otherall.cn"; content:"|08|otherall|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130008; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain otherchina.cn"; content:"|0a|otherchina|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130009; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain otimagrafica.com"; content:"|0c|otimagrafica|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130010; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ouiu.cn"; content:"|04|ouiu|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130011; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain outinfo.studenthost.ru"; content:"|07|outinfo|0b|studenthost|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130012; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain p1anka.cn"; content:"|06|p1anka|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130013; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain panmiamibeach.com"; content:"|0d|panmiamibeach|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130014; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain parfaitpournous.com"; content:"|0f|parfaitpournous|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130015; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain parliament.tk"; content:"|0a|parliament|02|tk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130016; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pausestorm.com"; content:"|0a|pausestorm|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130017; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain paypay.co"; content:"|06|paypay|02|co"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130018; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pdx1online.com"; content:"|0a|pdx1online|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130019; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pelmeshko.cn"; content:"|09|pelmeshko|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130020; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain perezinstitute.com"; content:"|0e|perezinstitute|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130021; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain perichikkk.com"; content:"|0a|perichikkk|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130022; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain permanentgoodazmark.com"; content:"|13|permanentgoodazmark|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130023; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain perrys.ath.cx"; content:"|06|perrys|03|ath|02|cx"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130024; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain persivkrovis.info"; content:"|0c|persivkrovis|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130025; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain phaizeipeu.ru"; content:"|0a|phaizeipeu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130026; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain phcconsulting.info"; content:"|0d|phcconsulting|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130027; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain photobank.pasweokz.com"; content:"|09|photobank|08|pasweokz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130028; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain photostock.pasweq.co.kr"; content:"|0a|photostock|06|pasweq|02|co|02|kr"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130029; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain photovideo.uz"; content:"|0a|photovideo|02|uz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130030; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain picula.ru"; content:"|06|picula|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130031; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pilonoc.cn"; content:"|07|pilonoc|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130032; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pinzec.hut2.ru"; content:"|06|pinzec|04|hut2|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130033; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pinzec1.hut2.ru"; content:"|07|pinzec1|04|hut2|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130034; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pipeccc.info"; content:"|07|pipeccc|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130035; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pipiskin.hk"; content:"|08|pipiskin|02|hk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130036; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pitorysoue.com"; content:"|0a|pitorysoue|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130037; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain platinal.com"; content:"|08|platinal|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130038; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain platinumhostingservice.com"; content:"|16|platinumhostingservice|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130039; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain platnuki.ru"; content:"|08|platnuki|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130040; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pllae.ru"; content:"|05|pllae|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130041; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain plumberg.cn"; content:"|08|plumberg|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130042; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain plumberga.cn"; content:"|09|plumberga|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130043; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pnp2biz.com.tw"; content:"|07|pnp2biz|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130044; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pnp2bizforum.com"; content:"|0c|pnp2bizforum|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130045; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pobedim.cn"; content:"|07|pobedim|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130046; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain podgorz.org"; content:"|07|podgorz|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130047; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain podzemje.cn"; content:"|08|podzemje|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130048; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pogoaliceadvance.com"; content:"|10|pogoaliceadvance|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130049; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain polygraphy-p.ru"; content:"|0c|polygraphy-p|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130050; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain popunserv.com"; content:"|09|popunserv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130051; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pornoland7.ru"; content:"|0a|pornoland7|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130052; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain portisheadmusic15.net"; content:"|11|portisheadmusic15|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130053; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain postmetoday.ru"; content:"|0b|postmetoday|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130054; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain poteriapoter.com"; content:"|0c|poteriapoter|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130055; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pozemk.com"; content:"|06|pozemk|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130056; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ppherph.com"; content:"|07|ppherph|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130057; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pradsuyz.cn"; content:"|08|pradsuyz|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130058; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pravolevo.net"; content:"|09|pravolevo|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130059; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pravoved.pl.ua"; content:"|08|pravoved|02|pl|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130060; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain prawns.kosherfishery.com"; content:"|06|prawns|0d|kosherfishery|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130061; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain presentsdelivery.com"; content:"|10|presentsdelivery|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130062; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain preypal.org.uk"; content:"|07|preypal|03|org|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130063; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain primusdns.ru"; content:"|09|primusdns|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130064; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain print-design.cn"; content:"|0c|print-design|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130065; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain printbalance.com"; content:"|0c|printbalance|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130066; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pro-dancing.com"; content:"|0b|pro-dancing|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130067; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain profincorp.com"; content:"|0a|profincorp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130068; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain progledeltru.eu"; content:"|0c|progledeltru|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130069; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain projectcurtis.com"; content:"|0d|projectcurtis|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130070; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain projectijtihad.com"; content:"|0e|projectijtihad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130071; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain promo-standart.info"; content:"|0e|promo-standart|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130072; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain promodetz.com"; content:"|09|promodetz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130073; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain promowho.net"; content:"|08|promowho|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130074; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain protologim.com"; content:"|0a|protologim|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130075; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain psycho.lv"; content:"|06|psycho|02|lv"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130076; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pteradaktel.net"; content:"|0b|pteradaktel|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130077; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ptichkaleti88.com"; content:"|0d|ptichkaleti88|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130078; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain puppetmasterz.org"; content:"|0d|puppetmasterz|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130079; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain purplepron.ru"; content:"|0a|purplepron|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130080; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pusicat.co.uk"; content:"|07|pusicat|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130081; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pxcallcentercareers.com"; content:"|13|pxcallcentercareers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130082; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain qpolf.ru"; content:"|05|qpolf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130083; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain qpsk2.ru"; content:"|05|qpsk2|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130084; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain quebec3465.com"; content:"|0a|quebec3465|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130085; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain quickshows.cn"; content:"|0a|quickshows|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130086; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain qyclub.com.cn"; content:"|06|qyclub|03|com|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130087; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain railuhocal.ru"; content:"|0a|railuhocal|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130088; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rainbox.info"; content:"|07|rainbox|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130089; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ramblerbot.ru"; content:"|0a|ramblerbot|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130090; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ramona4u.go.ro"; content:"|08|ramona4u|02|go|02|ro"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130091; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rapidshareds.com"; content:"|0c|rapidshareds|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130092; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain raskeni.ru"; content:"|07|raskeni|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130093; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain raushan.org"; content:"|07|raushan|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130094; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain real-warez.real-host.ru"; content:"|0a|real-warez|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130095; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain realfun.ro"; content:"|07|realfun|02|ro"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130096; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain realtorrentltd.ru"; content:"|0e|realtorrentltd|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130097; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain realtybestus.com"; content:"|0c|realtybestus|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130098; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain recessa.ru"; content:"|07|recessa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130099; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain recover777.com"; content:"|0a|recover777|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130100; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain recover7777.com"; content:"|0b|recover7777|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130101; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain recover88888.com"; content:"|0c|recover88888|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130102; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain recrush.ru"; content:"|07|recrush|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130103; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain redee3e.com.pl"; content:"|07|redee3e|03|com|02|pl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130104; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain redmapsis.com"; content:"|09|redmapsis|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130105; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain redondo.ru"; content:"|07|redondo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130106; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ree.fcrazy.eu"; content:"|03|ree|06|fcrazy|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130107; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain regaledgh7.info"; content:"|0a|regaledgh7|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130108; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain regularsystemupdates.asia"; content:"|14|regularsystemupdates|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130109; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain reklamaservice.org"; content:"|0e|reklamaservice|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130110; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain reklamen6.ru"; content:"|09|reklamen6|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130111; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain reklamen7.ru"; content:"|09|reklamen7|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130112; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain relaxsearch.uphero.com"; content:"|0b|relaxsearch|06|uphero|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130113; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain remot.today-saturday.cn"; content:"|05|remot|0e|today-saturday|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130114; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rendom.mx"; content:"|06|rendom|02|mx"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130115; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain repkamouse.net"; content:"|0a|repkamouse|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130116; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain repuzer.net.ua"; content:"|07|repuzer|03|net|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130117; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain reservedomainforzs1.com"; content:"|13|reservedomainforzs1|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130118; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain revoset.cn"; content:"|07|revoset|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130119; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rezervzv.ru"; content:"|08|rezervzv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130120; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain riaptfnrvmr.com"; content:"|0b|riaptfnrvmr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130121; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rizzle.net"; content:"|06|rizzle|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130122; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rjkifj.cn"; content:"|06|rjkifj|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130123; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rmtiw.ru"; content:"|05|rmtiw|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130124; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ro.cybercartel.biz"; content:"|02|ro|0b|cybercartel|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130125; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain robertomilanomoreomglol.info"; content:"|17|robertomilanomoreomglol|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130126; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain robotbobot.cn"; content:"|0a|robotbobot|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130127; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain robul.net"; content:"|05|robul|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130128; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rodjerio.com"; content:"|08|rodjerio|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130129; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain roideada.com"; content:"|08|roideada|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130130; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain romanticdateonline.com"; content:"|12|romanticdateonline|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130131; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain roop.barxlays.co.uk"; content:"|04|roop|08|barxlays|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130132; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain roundhome.net"; content:"|09|roundhome|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130133; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rp-legal.ro"; content:"|08|rp-legal|02|ro"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130134; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rpmm0.cn"; content:"|05|rpmm0|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130135; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rrrekti.ru"; content:"|07|rrrekti|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130136; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rsafw.com"; content:"|05|rsafw|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130137; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rttta.ru"; content:"|05|rttta|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130138; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rubychief.com"; content:"|09|rubychief|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130139; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rulesselur.com"; content:"|0a|rulesselur|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130140; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain runtarius.cc"; content:"|09|runtarius|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130141; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ruskod.com.ru"; content:"|06|ruskod|03|com|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130142; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ruskod.net.ru"; content:"|06|ruskod|03|net|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130143; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ruskod.org.ru"; content:"|06|ruskod|03|org|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130144; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain russianmomds.ru"; content:"|0c|russianmomds|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130145; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rustat.su"; content:"|06|rustat|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130146; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ruxyjatech.com"; content:"|0a|ruxyjatech|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130147; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain s-domain.cn"; content:"|08|s-domain|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130148; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain safe-web.name"; content:"|08|safe-web|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130149; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain safeserfing.ru"; content:"|0b|safeserfing|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130150; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain safewhales.ws"; content:"|0a|safewhales|02|ws"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130151; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain saill.asia"; content:"|05|saill|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130152; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain saintsup.com"; content:"|08|saintsup|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130153; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sakura2.cn"; content:"|07|sakura2|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130154; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain salamandainword.ru"; content:"|0f|salamandainword|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130155; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain salx.cc"; content:"|04|salx|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130156; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain samson.real-host.ru"; content:"|06|samson|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130157; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain saragranroth.com"; content:"|0c|saragranroth|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130158; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sas.1337hosting.info"; content:"|03|sas|0b|1337hosting|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130159; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sashahost.cn"; content:"|09|sashahost|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130160; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sattor.cn"; content:"|06|sattor|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130161; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain scan-sec.com"; content:"|08|scan-sec|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130162; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sdlls.ru"; content:"|05|sdlls|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130163; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain searchadvertsol.net"; content:"|0f|searchadvertsol|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130164; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain searchbestsleep.com"; content:"|0f|searchbestsleep|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130165; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain seawizard.net"; content:"|09|seawizard|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130166; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sec.livecasting33.com"; content:"|03|sec|0d|livecasting33|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130167; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain seclinezzz.net"; content:"|0a|seclinezzz|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130168; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain secure-networks.cn"; content:"|0f|secure-networks|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130169; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain secure.valid.cc"; content:"|06|secure|05|valid|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130170; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain securesustemupdates.asia"; content:"|13|securesustemupdates|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130171; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain securityinternacces.com"; content:"|13|securityinternacces|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130172; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sedoborod.cn"; content:"|09|sedoborod|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130173; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sefergtrserfv.biz"; content:"|0d|sefergtrserfv|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130174; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sefergtrserfv.ru"; content:"|0d|sefergtrserfv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130175; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain seistic.org"; content:"|07|seistic|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130176; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sekmoon.net"; content:"|07|sekmoon|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130177; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain senrofay.cn"; content:"|08|senrofay|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130178; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain serfinworld.com"; content:"|0b|serfinworld|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130179; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sergeus200.real-host.ru"; content:"|0a|sergeus200|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130180; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sero86.ru"; content:"|06|sero86|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130181; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain server.18cyber.com"; content:"|06|server|07|18cyber|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130182; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain server1.servingsupport.com"; content:"|07|server1|0e|servingsupport|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130183; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain servermail.real-host.ru"; content:"|0a|servermail|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130184; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain servertransporternews.com"; content:"|15|servertransporternews|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130185; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain serviceexe.com"; content:"|0a|serviceexe|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130186; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain servicesocks5.cn"; content:"|0d|servicesocks5|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130187; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain servtemp.info"; content:"|08|servtemp|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130188; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain setyupdate.com"; content:"|0a|setyupdate|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130189; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sexypupsik.cn"; content:"|0a|sexypupsik|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130190; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shadowtycoon.com"; content:"|0c|shadowtycoon|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130191; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shd3h80nd348dhn348f34hinom9io.com"; content:"|1d|shd3h80nd348dhn348f34hinom9io|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130192; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shipal.eu"; content:"|06|shipal|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130193; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ships.ath.cx"; content:"|05|ships|03|ath|02|cx"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130194; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shkafu.net"; content:"|06|shkafu|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130195; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shkens.net"; content:"|06|shkens|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130196; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain showersystemreviews.com"; content:"|13|showersystemreviews|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130197; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shwarzgold.com"; content:"|0a|shwarzgold|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130198; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain siftozzillaa.cn"; content:"|0c|siftozzillaa|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130199; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain silence7.cn"; content:"|08|silence7|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130200; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain silentpanel.name"; content:"|0b|silentpanel|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130201; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain silvton.cn"; content:"|07|silvton|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130202; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain simmentog.com"; content:"|09|simmentog|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130203; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sir-t.cn"; content:"|05|sir-t|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130204; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sirius-socks.cn"; content:"|0c|sirius-socks|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130205; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sj82hags6.com"; content:"|09|sj82hags6|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130206; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain skodaligthcx.ru"; content:"|0c|skodaligthcx|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130207; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain slasher.c2boffshore.com"; content:"|07|slasher|0b|c2boffshore|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130208; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain slavenkad.com"; content:"|09|slavenkad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130209; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain slmsezs.co.cc"; content:"|07|slmsezs|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130210; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain slmstse.co.cc"; content:"|07|slmstse|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130211; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain slsmdns.co.cc"; content:"|07|slsmdns|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130212; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smallteam.cn"; content:"|09|smallteam|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130213; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smile.if.ua"; content:"|05|smile|02|if|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130214; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smlsesd.co.cc"; content:"|07|smlsesd|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130215; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smmazdt.co.cc"; content:"|07|smmazdt|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130216; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smmseza.co.cc"; content:"|07|smmseza|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130217; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sng-soft.com"; content:"|08|sng-soft|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130218; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sobakozgav.net"; content:"|0a|sobakozgav|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130219; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain socks5servise.cn"; content:"|0d|socks5servise|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130220; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain softinfosite.com"; content:"|0c|softinfosite|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130221; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sollutsn.biz"; content:"|08|sollutsn|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130222; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain solo1928.ru"; content:"|08|solo1928|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130223; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sonyproduction.in"; content:"|0e|sonyproduction|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130224; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sosiska.cn"; content:"|07|sosiska|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130225; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sourtel.com"; content:"|07|sourtel|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130226; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sourtel1.com"; content:"|08|sourtel1|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130227; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spacebuxer.com"; content:"|0a|spacebuxer|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130228; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spacecountry.cn"; content:"|0c|spacecountry|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130229; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spainfoodandwine.com"; content:"|10|spainfoodandwine|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130230; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spanukk.phpnet.us"; content:"|07|spanukk|06|phpnet|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130231; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sparkleroads.com"; content:"|0c|sparkleroads|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130232; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spasicomp.com"; content:"|09|spasicomp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130233; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spendolo.com"; content:"|08|spendolo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130234; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spics.servepics.com"; content:"|05|spics|09|servepics|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130235; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spiritnum.com"; content:"|09|spiritnum|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130236; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sportfinish.cn"; content:"|0b|sportfinish|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130237; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sportshots.cn"; content:"|0a|sportshots|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130238; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sprottcareers.com"; content:"|0d|sprottcareers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130239; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain srty.nei28.com"; content:"|04|srty|05|nei28|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130240; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain srvdlls.ru"; content:"|07|srvdlls|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130241; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ssdzamd.co.cc"; content:"|07|ssdzamd|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130242; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sseusms.co.cc"; content:"|07|sseusms|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130243; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ssezsea.co.cc"; content:"|07|ssezsea|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130244; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ssl-molotok.ru"; content:"|0b|ssl-molotok|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130245; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sslillisilsltlis.com"; content:"|10|sslillisilsltlis|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130246; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sstdsclick1.com"; content:"|0b|sstdsclick1|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130247; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain st-resources.net"; content:"|0c|st-resources|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130248; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain starcountry.ru"; content:"|0b|starcountry|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130249; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain starsico.ru"; content:"|08|starsico|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130250; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain start.real-host.ru"; content:"|05|start|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130251; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain static-bay.org.uk"; content:"|0a|static-bay|03|org|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130252; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain statistics-of-world.org"; content:"|13|statistics-of-world|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130253; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stats.kuldipadvertisements.info"; content:"|05|stats|14|kuldipadvertisements|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130254; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sthsdla.co.cc"; content:"|07|sthsdla|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130255; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stomaid.ru"; content:"|07|stomaid|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130256; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stopwarsintheworld.com"; content:"|12|stopwarsintheworld|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130257; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stovery.cn"; content:"|07|stovery|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130258; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain strbypass.uz.ua"; content:"|09|strbypass|02|uz|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130259; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain streetstorm.eu"; content:"|0b|streetstorm|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130260; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain subaruservice.cn"; content:"|0d|subaruservice|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130261; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain subvencionwest.com"; content:"|0e|subvencionwest|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130262; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sumyho.cn"; content:"|06|sumyho|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130263; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain supermamba.com"; content:"|0a|supermamba|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130264; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain suphazgdman.com"; content:"|0b|suphazgdman|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130265; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sureameritradex.com"; content:"|0f|sureameritradex|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130266; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain susez.mine.nu"; content:"|05|susez|04|mine|02|nu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130267; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain suvaf.wapdodoit.ru"; content:"|05|suvaf|09|wapdodoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130268; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain svinopavstvo.cn"; content:"|0c|svinopavstvo|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130269; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain svyazko.3rdx.com"; content:"|07|svyazko|04|3rdx|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130270; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain swedpank.cn"; content:"|08|swedpank|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130271; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sympathy.hdnews.net"; content:"|08|sympathy|06|hdnews|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130272; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain symyho331.cn"; content:"|09|symyho331|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130273; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain symyho3393245.cn"; content:"|0d|symyho3393245|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130274; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sys32.info"; content:"|05|sys32|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130275; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain szsdmst.co.cc"; content:"|07|szsdmst|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130276; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain szsemse.co.cc"; content:"|07|szsemse|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130277; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain szysese.co.cc"; content:"|07|szysese|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130278; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain szzssda.co.cc"; content:"|07|szzssda|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130279; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain t0rb.tk"; content:"|04|t0rb|02|tk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130280; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ta1ch1.cn"; content:"|06|ta1ch1|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130281; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain taboo.serveblog.net"; content:"|05|taboo|09|serveblog|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130282; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain taipeifubonban.info"; content:"|0e|taipeifubonban|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130283; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain talents-dz.com"; content:"|0a|talents-dz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130284; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tarstall.ru"; content:"|08|tarstall|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130285; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tdsnumero.cn"; content:"|09|tdsnumero|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130286; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain technoplast.com.ua"; content:"|0b|technoplast|03|com|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130287; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain technotronics.cn"; content:"|0d|technotronics|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130288; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain technotrucks.net"; content:"|0c|technotrucks|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130289; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tempr.ru"; content:"|05|tempr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130290; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain test2.salefale.com"; content:"|05|test2|08|salefale|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130291; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thebfdshop.com"; content:"|0a|thebfdshop|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130292; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thedownget.com"; content:"|0a|thedownget|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130293; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thefinmodel.com"; content:"|0b|thefinmodel|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130294; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain theit.cc"; content:"|05|theit|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130295; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thelegallywildbunch.com"; content:"|13|thelegallywildbunch|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130296; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thelinx.info"; content:"|07|thelinx|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130297; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain theprotection.km.ua"; content:"|0d|theprotection|02|km|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130298; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thereismypuper-gb.com"; content:"|11|thereismypuper-gb|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130299; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thereismysuper-d.com"; content:"|10|thereismysuper-d|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130300; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thetrinity.com.tw"; content:"|0a|thetrinity|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130301; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain theusbwebsite.cn"; content:"|0d|theusbwebsite|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130302; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thewayithastobe.com"; content:"|0f|thewayithastobe|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130303; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain this-all-clean.com"; content:"|0e|this-all-clean|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130304; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain threemonthscar.com"; content:"|0e|threemonthscar|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130305; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tieos.com"; content:"|05|tieos|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130306; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tigerm.ru"; content:"|06|tigerm|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130307; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tiho.polomaem.cn"; content:"|04|tiho|08|polomaem|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130308; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tissot333.cn"; content:"|09|tissot333|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130309; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tjkd.info"; content:"|04|tjkd|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130310; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tjkleen.net"; content:"|07|tjkleen|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130311; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain to.zuo.hu"; content:"|02|to|03|zuo|02|hu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130312; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tobacktoback.com"; content:"|0c|tobacktoback|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130313; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tolima.cn"; content:"|06|tolima|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130314; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tollukk88.com"; content:"|09|tollukk88|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130315; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tomorrrrow.cc"; content:"|0a|tomorrrrow|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130316; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain top5000.org"; content:"|07|top5000|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130317; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain top5z.com"; content:"|05|top5z|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130318; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain torre.asia"; content:"|05|torre|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130319; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain totalunix.net"; content:"|09|totalunix|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130320; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain toutube.cn"; content:"|07|toutube|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130321; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain toxicfree.ssht.kr"; content:"|09|toxicfree|04|ssht|02|kr"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130322; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tr1dent.org"; content:"|07|tr1dent|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130323; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trachsel.biz"; content:"|08|trachsel|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130324; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tracker.bizrgm.com"; content:"|07|tracker|06|bizrgm|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130325; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain traff.street-info.com"; content:"|05|traff|0b|street-info|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130326; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trafficsupple.ru"; content:"|0d|trafficsupple|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130327; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain transjapan.ru"; content:"|0a|transjapan|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130328; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain translatespanish.ru"; content:"|10|translatespanish|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130329; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain transliators.cn"; content:"|0c|transliators|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130330; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain transport96.ru"; content:"|0b|transport96|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130331; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tranzmerc.org"; content:"|09|tranzmerc|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130332; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain traskl.ru"; content:"|06|traskl|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130333; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trastlifer.hk"; content:"|0a|trastlifer|02|hk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130334; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain treverthisone.com"; content:"|0d|treverthisone|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130335; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trfn.salefale.com"; content:"|04|trfn|08|salefale|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130336; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trinnitti-soft.org"; content:"|0e|trinnitti-soft|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130337; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trollar.ru"; content:"|07|trollar|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130338; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ttl-host.com"; content:"|08|ttl-host|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130339; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tttbbbttt.ru"; content:"|09|tttbbbttt|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130340; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tuktuk.su"; content:"|06|tuktuk|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130341; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tutsi.net.ua"; content:"|05|tutsi|03|net|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130342; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tvbingoshow.biz"; content:"|0b|tvbingoshow|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130343; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ubagubagurame.biz"; content:"|0d|ubagubagurame|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130344; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ubojnajasila.net"; content:"|0c|ubojnajasila|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130345; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ubuuntu.info"; content:"|07|ubuuntu|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130346; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uffertyew.cn"; content:"|09|uffertyew|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130347; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uiao.ru"; content:"|04|uiao|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130348; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uk.69.mu"; content:"|02|uk|02|69|02|mu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130349; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ukboox.com"; content:"|06|ukboox|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130350; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ukcallcentercareers.com"; content:"|13|ukcallcentercareers|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130351; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ukliit.cn"; content:"|06|ukliit|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130352; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ukosp.com"; content:"|05|ukosp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130353; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uktop10banksreview.com"; content:"|12|uktop10banksreview|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130354; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ultra-light4u.net"; content:"|0d|ultra-light4u|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130355; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain umor.sumy.ua"; content:"|04|umor|04|sumy|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130356; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain unedge.net"; content:"|06|unedge|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130357; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uniqez.cn"; content:"|06|uniqez|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130358; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain unoparketiklo.com"; content:"|0d|unoparketiklo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130359; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain untitled-themovie.com"; content:"|11|untitled-themovie|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130360; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain update-flash.com"; content:"|0c|update-flash|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130361; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain update-java3.com"; content:"|0c|update-java3|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130362; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain update-java4.com"; content:"|0c|update-java4|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130363; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain update-kabul.com"; content:"|0c|update-kabul|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130364; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain update-office.com"; content:"|0d|update-office|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130365; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain update4ever.ru"; content:"|0b|update4ever|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130366; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uplevelgmno.vn.ua"; content:"|0b|uplevelgmno|02|vn|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130367; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uploadhost.zapto.org"; content:"|0a|uploadhost|05|zapto|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130368; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain urbanmilk.ru"; content:"|09|urbanmilk|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130369; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain url.fmip.org"; content:"|03|url|04|fmip|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130370; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain usa.hostbaron.com"; content:"|03|usa|09|hostbaron|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130371; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uscguard.com"; content:"|08|uscguard|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130372; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain userprivileges.net"; content:"|0e|userprivileges|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130373; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ushenkohuivolosatiy.ru"; content:"|13|ushenkohuivolosatiy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130374; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ushship.com"; content:"|07|ushship|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130375; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ustunoto.com.tr"; content:"|08|ustunoto|03|com|02|tr"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130376; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uyerfbvo.cn"; content:"|08|uyerfbvo|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130377; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uytrec.cn"; content:"|06|uytrec|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130378; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain v-murmanske.ru"; content:"|0b|v-murmanske|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130379; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vaiocluberifvreiwweuv.com"; content:"|15|vaiocluberifvreiwweuv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130380; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain validating.ru"; content:"|0a|validating|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130381; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain varxx.com"; content:"|05|varxx|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130382; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vaseacubmw.com"; content:"|0a|vaseacubmw|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130383; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vaseajretikru.com"; content:"|0d|vaseajretikru|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130384; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vazegdurak.cn"; content:"|0a|vazegdurak|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130385; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vbcveeuvthr.com"; content:"|0b|vbcveeuvthr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130386; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vbmn.info"; content:"|04|vbmn|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130387; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vds-6ae9.1gb.ua"; content:"|08|vds-6ae9|03|1gb|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130388; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain velokot.org"; content:"|07|velokot|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130389; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ventureiusaj.net"; content:"|0c|ventureiusaj|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130390; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain verde.esmasamor.com"; content:"|05|verde|09|esmasamor|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130391; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain veridatalookup.com"; content:"|0e|veridatalookup|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130392; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain verter2010.real-host.ru"; content:"|0a|verter2010|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130393; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vertucom62.me"; content:"|0a|vertucom62|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130394; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain verybigmoney.cv.ua"; content:"|0c|verybigmoney|02|cv|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130395; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vfgplnovthr.com"; content:"|0b|vfgplnovthr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130396; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain victorry.ru"; content:"|08|victorry|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130397; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain videobusiness.ru"; content:"|0d|videobusiness|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130398; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vilkgood.cn"; content:"|08|vilkgood|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130399; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vinodel.if.ua"; content:"|07|vinodel|02|if|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130400; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vipcont.ru"; content:"|07|vipcont|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130401; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vipeks.cn"; content:"|06|vipeks|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130402; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain viponlineshopworld.com"; content:"|12|viponlineshopworld|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130403; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain visatour.asia"; content:"|08|visatour|04|asia"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130404; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vk-bot.ru"; content:"|06|vk-bot|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130405; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vkontakte-theme.ru"; content:"|0f|vkontakte-theme|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130406; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vkontax.net"; content:"|07|vkontax|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130407; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vkpriz.com"; content:"|06|vkpriz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130408; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vladimir-dz.dynalias.org"; content:"|0b|vladimir-dz|08|dynalias|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130409; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vladlen.real-host.ru"; content:"|07|vladlen|09|real-host|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130410; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vohphozeeg.ru"; content:"|0a|vohphozeeg|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130411; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain voidrage.com"; content:"|08|voidrage|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130412; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain voina83737.com"; content:"|0a|voina83737|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130413; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain volkahatab.cc"; content:"|0a|volkahatab|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130414; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain volkanboya.com"; content:"|0a|volkanboya|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130415; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vopret.ru"; content:"|06|vopret|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130416; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain voraciousutre5.info"; content:"|0e|voraciousutre5|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130417; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain voraojoong.ru"; content:"|0a|voraojoong|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130418; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vrvv.ru"; content:"|04|vrvv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130419; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vseserioznocb.megabyet.net"; content:"|0d|vseserioznocb|08|megabyet|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130420; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vviv.ru"; content:"|04|vviv|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130421; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vvmmp.ru"; content:"|05|vvmmp|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130422; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vxuservx.com"; content:"|08|vxuservx|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130423; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wabkvtiwthr.com"; content:"|0b|wabkvtiwthr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130424; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain walterex.info"; content:"|08|walterex|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130425; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wcup2010.cc"; content:"|08|wcup2010|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130426; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain web-e-mail.net"; content:"|0a|web-e-mail|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130427; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain webentersite.com"; content:"|0c|webentersite|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130428; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain webmoney-job.ru"; content:"|0c|webmoney-job|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130429; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain weed.sindromx.net.ua"; content:"|04|weed|08|sindromx|03|net|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130430; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain weedies.net"; content:"|07|weedies|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130431; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain werh.biz"; content:"|04|werh|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130432; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain werrrcorp.com"; content:"|09|werrrcorp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130433; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain whiteagngo.com"; content:"|0a|whiteagngo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130434; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain whitehorce.com"; content:"|0a|whitehorce|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130435; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain whoismak.net"; content:"|08|whoismak|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130436; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wifahquaht.ru"; content:"|0a|wifahquaht|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130437; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wildbunchwtf.com"; content:"|0c|wildbunchwtf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130438; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain williamsentry.com"; content:"|0d|williamsentry|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130439; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wind10.com"; content:"|06|wind10|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130440; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain windows-update.cn"; content:"|0e|windows-update|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130441; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain windows-update210.com"; content:"|11|windows-update210|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130442; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain windows7-catalog.cn"; content:"|10|windows7-catalog|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130443; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain windowsserverinfo.com"; content:"|11|windowsserverinfo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130444; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain winsofter.ru"; content:"|09|winsofter|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130445; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wmatm.ru"; content:"|05|wmatm|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130446; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wmbarnaul.info"; content:"|09|wmbarnaul|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130447; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wngo.ru"; content:"|04|wngo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130448; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wolfinformatics.ch"; content:"|0f|wolfinformatics|02|ch"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130449; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain woodeko.com"; content:"|07|woodeko|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130450; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain woodruby.net"; content:"|08|woodruby|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130451; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain woot.ccpower.bz"; content:"|04|woot|07|ccpower|02|bz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130452; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain worksofast.ru"; content:"|0a|worksofast|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130453; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain worldnetdirect.com"; content:"|0e|worldnetdirect|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130454; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain worldwesttrans.com"; content:"|0e|worldwesttrans|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130455; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wrangel55.biz.preview.ihc.ru"; content:"|09|wrangel55|03|biz|07|preview|03|ihc|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130456; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wrefraquaf.tw"; content:"|0a|wrefraquaf|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130457; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wvvl.faramandi.org"; content:"|04|wvvl|09|faramandi|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130458; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wvvw.dns-configs.net"; content:"|04|wvvw|0b|dns-configs|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130459; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wvvw.my-dns-stat.net"; content:"|04|wvvw|0b|my-dns-stat|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130460; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wvw.msnstats.net"; content:"|03|wvw|08|msnstats|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130461; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wvw.stats-serv.net"; content:"|03|wvw|0a|stats-serv|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130462; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.aksobor.ru"; content:"|03|www|07|aksobor|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130463; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.alcamarsaci.cl"; content:"|03|www|0b|alcamarsaci|02|cl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130464; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.fem2.net"; content:"|03|www|04|fem2|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130465; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.gaddem.net"; content:"|03|www|06|gaddem|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130466; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.kazanovshina.ru"; content:"|03|www|0c|kazanovshina|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130467; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.n950.info"; content:"|03|www|04|n950|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130468; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.salamandainword.ru"; content:"|03|www|0f|salamandainword|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130469; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.tklasx.da.ru"; content:"|03|www|06|tklasx|02|da|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130470; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.win-uploads.net"; content:"|03|www|0b|win-uploads|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130471; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.your-updates.net"; content:"|03|www|0c|your-updates|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130472; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wxw.ms-update.net"; content:"|03|wxw|09|ms-update|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130473; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain x-monitoring.com"; content:"|0c|x-monitoring|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130474; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xareemudeixa.com"; content:"|0c|xareemudeixa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130475; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xborjom.com"; content:"|07|xborjom|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130476; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xcorp.net.cn"; content:"|05|xcorp|03|net|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130477; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xe54.com"; content:"|04|xe54|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130478; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xee1aeph2aay.kz"; content:"|0c|xee1aeph2aay|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130479; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xepace.cn"; content:"|06|xepace|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130480; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xiphrix.customer.attikh.net"; content:"|07|xiphrix|08|customer|06|attikh|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130481; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xsnatch.cc"; content:"|07|xsnatch|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130482; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xvaluegate.com"; content:"|0a|xvaluegate|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130483; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xw0v.info"; content:"|04|xw0v|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130484; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xx-monitoring.com"; content:"|0d|xx-monitoring|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130485; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xxxdessert.name"; content:"|0a|xxxdessert|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130486; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xxxvidzforfree.net"; content:"|0e|xxxvidzforfree|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130487; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xyseinobama.name"; content:"|0b|xyseinobama|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130488; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yad.stelladimare.ru"; content:"|03|yad|0c|stelladimare|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130489; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yeeshiedot.ru"; content:"|0a|yeeshiedot|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130490; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yesandns.cn"; content:"|08|yesandns|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130491; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yesoc.in"; content:"|05|yesoc|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130492; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ygyg.net"; content:"|04|ygyg|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130493; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain youmoneyway.cc"; content:"|0b|youmoneyway|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130494; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain your-up-search.net"; content:"|0e|your-up-search|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130495; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yourgoogleanalytics.com"; content:"|13|yourgoogleanalytics|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130496; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yourgoogleanalytics.eu"; content:"|13|yourgoogleanalytics|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130497; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yourgunparts.com"; content:"|0c|yourgunparts|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130498; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yourkep.com"; content:"|07|yourkep|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130499; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain youwillfindtheresomethinginterestinf.com"; content:"|24|youwillfindtheresomethinginterestinf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130500; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yrganosserx.net"; content:"|0b|yrganosserx|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130501; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yrots.ru"; content:"|05|yrots|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130502; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yyer.ru"; content:"|04|yyer|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130503; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yyycejui.org"; content:"|08|yyycejui|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130504; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z.ins.ge"; content:"|01|z|03|ins|02|ge"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130505; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z.peliman.net"; content:"|01|z|07|peliman|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130506; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z.poafirst.com"; content:"|01|z|08|poafirst|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130507; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z.sunbon.net"; content:"|01|z|06|sunbon|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130508; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z140877.infobox.ru"; content:"|07|z140877|07|infobox|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130509; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z141795.infobox.ru"; content:"|07|z141795|07|infobox|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130510; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zadovsite.net"; content:"|09|zadovsite|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130511; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zaebalivse.net"; content:"|0a|zaebalivse|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130512; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zanga.haos.ro"; content:"|05|zanga|04|haos|02|ro"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130513; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zbzr.ru"; content:"|04|zbzr|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130514; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zebra.ignorelist.com"; content:"|05|zebra|0a|ignorelist|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130515; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeferesds.com"; content:"|09|zeferesds|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130516; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zephehooqu.ru"; content:"|0a|zephehooqu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130517; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeppbrannigan.com"; content:"|0d|zeppbrannigan|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130518; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zerg-invest.com"; content:"|0b|zerg-invest|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130519; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeromagic.spb.ru"; content:"|09|zeromagic|03|spb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130520; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeus-logs.org"; content:"|09|zeus-logs|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130521; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeus.bnetinvaderz.com"; content:"|04|zeus|0c|bnetinvaderz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130522; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeusbot.xvn.in"; content:"|07|zeusbot|03|xvn|02|in"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130523; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zeusbotnet.dvrdns.org"; content:"|0a|zeusbotnet|06|dvrdns|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130524; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zevaka2.cn"; content:"|07|zevaka2|02|cn"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130525; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zion-z0ne.net"; content:"|09|zion-z0ne|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130526; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zmagazine.ru"; content:"|09|zmagazine|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130527; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zonephp.com"; content:"|07|zonephp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130528; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zouweengongohgaegeetiebi.com"; content:"|18|zouweengongohgaegeetiebi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130529; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zroot.info.tm"; content:"|05|zroot|04|info|02|tm"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130530; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zuo.podgorz.org"; content:"|03|zuo|07|podgorz|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130531; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zxfr.salefale.com"; content:"|04|zxfr|08|salefale|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130532; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zzzzzz.com"; content:"|06|zzzzzz|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1130533; rev:3;)