# DNS Zeus rules by Jack Pepper ( pepperjack@autoshun.org ) # regenerated periodically from the domains file at abuse.ch # The URL for the abuse.ch site: https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist # The source URL for this http://www.autoshun.org/downloads/zeusdomain.rules # # # Sat, 04 Feb 2012 02:16:02 -0600 # Error on ############################################################################## # Error on # abuse.ch ZeuS domain blocklist # # Error on # # # Error on # For questions please refer to https://zeustracker.abuse.ch/blocklist.php # # Error on ############################################################################## # Error on alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 02c20c8.netsolhost.com"; content:"|07|02c20c8|0a|netsolhost|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129091; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 11plants.biz"; content:"|08|11plants|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129092; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 123002915.cn.com"; content:"|09|123002915|02|cn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129093; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 123adult123.com"; content:"|0b|123adult123|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129094; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 28843622.biz"; content:"|08|28843622|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129095; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 2x5.us"; content:"|03|2x5|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129096; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 360safeupdate02.gicp.net"; content:"|0f|360safeupdate02|04|gicp|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129097; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 3apa3a.tomsk.tw"; content:"|06|3apa3a|05|tomsk|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129098; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 423654m.cn.com"; content:"|07|423654m|02|cn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129099; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 7system.ezua.com"; content:"|07|7system|04|ezua|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129100; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 90fd78b9078bd0g.com"; content:"|0f|90fd78b9078bd0g|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129101; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain 98dfgr994883798df.com"; content:"|11|98dfgr994883798df|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129102; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain abc.googlezuju.com"; content:"|03|abc|0a|googlezuju|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129103; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain achecad.com"; content:"|07|achecad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129104; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain activedent.net"; content:"|0a|activedent|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129105; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain addweb.ru"; content:"|06|addweb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129106; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain adminpaneltestasdf000444.com.tw"; content:"|18|adminpaneltestasdf000444|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129107; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aeronitrex.com"; content:"|0a|aeronitrex|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129108; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain agedstuff.ru"; content:"|09|agedstuff|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129109; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain akronisltd.com"; content:"|0a|akronisltd|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129110; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain alcoholbuyonline.com"; content:"|10|alcoholbuyonline|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129111; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain all-nacha-datainfo.com"; content:"|12|all-nacha-datainfo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129112; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain altium.dev.hosting.rubius.com"; content:"|06|altium|03|dev|07|hosting|06|rubius|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129113; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amberschool.com"; content:"|0b|amberschool|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129114; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amberschool2.com"; content:"|0c|amberschool2|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129115; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain americanmobile.ca"; content:"|0e|americanmobile|02|ca"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129116; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain amstelone3.biz"; content:"|0a|amstelone3|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129117; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain anthonydeloso.com"; content:"|0d|anthonydeloso|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129118; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain antifoher.biz"; content:"|09|antifoher|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129119; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain antisorit.cn.com"; content:"|09|antisorit|02|cn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129120; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain anysnare.us"; content:"|08|anysnare|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129121; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aptitude.name"; content:"|08|aptitude|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129122; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aquaedition.com"; content:"|0b|aquaedition|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129123; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aquajaunt.com"; content:"|09|aquajaunt|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129124; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aquaskiff.com"; content:"|09|aquaskiff|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129125; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain aquasrc.com"; content:"|07|aquasrc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129126; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain arabiangoldenhorsestud.com"; content:"|16|arabiangoldenhorsestud|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129127; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ariodtalk.com"; content:"|09|ariodtalk|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129128; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain astrawebservice.com"; content:"|0f|astrawebservice|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129129; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain atlantatoagofs.ru"; content:"|0e|atlantatoagofs|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129130; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain atlantawadding.ru"; content:"|0e|atlantawadding|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129131; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain au-business-customer.com"; content:"|14|au-business-customer|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129132; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain axeswizardepx.ru"; content:"|0d|axeswizardepx|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129133; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain barugen.dlinkddns.com"; content:"|07|barugen|09|dlinkddns|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129134; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain basedmarket.com"; content:"|0b|basedmarket|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129135; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain basiliskos.ru"; content:"|0a|basiliskos|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129136; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain battlewright.com"; content:"|0c|battlewright|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129137; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain becutie.ru"; content:"|07|becutie|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129138; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bellicbridge.ru"; content:"|0c|bellicbridge|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129139; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bellicoreturbo.ru"; content:"|0e|bellicoreturbo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129140; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestlongnet.net"; content:"|0b|bestlongnet|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129141; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestsoftics.ru"; content:"|0b|bestsoftics|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129142; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bestvideoworld.com"; content:"|0e|bestvideoworld|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129143; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain betswinstrategy.cn.com"; content:"|0f|betswinstrategy|02|cn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129144; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain betternewyear.ru"; content:"|0d|betternewyear|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129145; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain biggestcoin.com"; content:"|0b|biggestcoin|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129146; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain biggestfunds.com"; content:"|0c|biggestfunds|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129147; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigimotopast.ru"; content:"|0c|bigimotopast|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129148; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigupdate.ru"; content:"|09|bigupdate|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129149; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigupdater.ru"; content:"|0a|bigupdater|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129150; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigupdaters.ru"; content:"|0b|bigupdaters|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129151; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigupdates.ru"; content:"|0a|bigupdates|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129152; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigupdating.ru"; content:"|0b|bigupdating|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129153; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bigupdatings.ru"; content:"|0c|bigupdatings|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129154; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain billycheerful.com"; content:"|0d|billycheerful|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129155; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain billyd.com.au"; content:"|06|billyd|03|com|02|au"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129156; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bisiteles.com"; content:"|09|bisiteles|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129157; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain blackbuckseri.com"; content:"|0d|blackbuckseri|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129158; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bluedisk.ru"; content:"|08|bluedisk|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129159; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bluelighttec.com"; content:"|0c|bluelighttec|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129160; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bmi.kurskstu.ru"; content:"|03|bmi|08|kurskstu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129161; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bonaquadjriga.ru"; content:"|0d|bonaquadjriga|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129162; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain boredret.ru"; content:"|08|boredret|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129163; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain botcat.la"; content:"|06|botcat|02|la"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129164; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain botnet.24fun.mk"; content:"|06|botnet|05|24fun|02|mk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129165; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain botnetdown.gicp.net"; content:"|0a|botnetdown|04|gicp|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129166; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain boutique26.ru"; content:"|0a|boutique26|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129167; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brandc.name"; content:"|06|brandc|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129168; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain brnsounds.cc"; content:"|09|brnsounds|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129169; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bsradio.ru"; content:"|07|bsradio|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129170; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bumptobabe.co.uk"; content:"|0a|bumptobabe|02|co|02|uk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129171; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain buyakabuyaka.kiev.ua"; content:"|0c|buyakabuyaka|04|kiev|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129172; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain bxkkuskgdjskdn.com"; content:"|0e|bxkkuskgdjskdn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129173; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cajecreative.com"; content:"|0c|cajecreative|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129174; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cakerecipes.ru"; content:"|0b|cakerecipes|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129175; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain callmenowhere.ru"; content:"|0d|callmenowhere|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129176; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cantst0pmenever.net"; content:"|0f|cantst0pmenever|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129177; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cc.kandek.com"; content:"|02|cc|06|kandek|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129178; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ccleanerwithsteak.co.cc"; content:"|11|ccleanerwithsteak|02|co|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129179; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cdkd.net"; content:"|04|cdkd|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129180; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cekcuc.ru"; content:"|06|cekcuc|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129181; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain champiogogo.ru"; content:"|0b|champiogogo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129182; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chamska.org"; content:"|07|chamska|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129183; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain charterbeans.info"; content:"|0c|charterbeans|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129184; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cherlend2.ru"; content:"|09|cherlend2|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129185; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain choiodos.kodingen.com"; content:"|08|choiodos|08|kodingen|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129186; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain chot-extreme.ru"; content:"|0c|chot-extreme|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129187; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain clickandjob.es"; content:"|0b|clickandjob|02|es"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129188; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain clickdapper.com"; content:"|0b|clickdapper|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129189; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain closedsource.cc"; content:"|0c|closedsource|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129190; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cloudsaround.ru"; content:"|0c|cloudsaround|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129191; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cloudy-dns.ru"; content:"|0a|cloudy-dns|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129192; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cnewsus.ru"; content:"|07|cnewsus|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129193; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cnnus.ru"; content:"|05|cnnus|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129194; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain companian-usa.ru"; content:"|0d|companian-usa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129195; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain coolsofa.ru"; content:"|08|coolsofa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129196; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cooltruling.ru"; content:"|0b|cooltruling|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129197; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain coooolzz.zapto.org"; content:"|08|coooolzz|05|zapto|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129198; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cornermarketmedia.com"; content:"|11|cornermarketmedia|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129199; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cosmetique-walker.de"; content:"|11|cosmetique-walker|02|de"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129200; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain countrysefa.org"; content:"|0b|countrysefa|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129201; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cp101.sharkserve.com"; content:"|05|cp101|0a|sharkserve|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129202; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain crm.hardcore-gym.net"; content:"|03|crm|0c|hardcore-gym|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129203; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cronjelaw.com"; content:"|09|cronjelaw|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129204; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cs2gameme.com"; content:"|09|cs2gameme|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129205; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cslrb-850-2.slc.westdc.net"; content:"|0b|cslrb-850-2|03|slc|06|westdc|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129206; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain curvechirp.com"; content:"|0a|curvechirp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129207; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cvvhouse.net"; content:"|08|cvvhouse|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129208; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain cyber-blade.net"; content:"|0b|cyber-blade|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129209; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain daosf3doapo.com"; content:"|0b|daosf3doapo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129210; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain daraskiluk.org"; content:"|0a|daraskiluk|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129211; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dartzofmybpull.ru"; content:"|0e|dartzofmybpull|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129212; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dasad41da4safasdasd21.biz"; content:"|15|dasad41da4safasdasd21|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129213; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain datacricketuf.ru"; content:"|0d|datacricketuf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129214; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dbi-static.com"; content:"|0a|dbi-static|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129215; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain delovar999.ru"; content:"|0a|delovar999|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129216; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain digibeetlesop.ru"; content:"|0d|digibeetlesop|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129217; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dileconme.hotmail.ru"; content:"|09|dileconme|07|hotmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129218; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain djpeterblue.com.br"; content:"|0b|djpeterblue|03|com|02|br"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129219; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain domainfortestingpanel999111.com.tw"; content:"|1b|domainfortestingpanel999111|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129220; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain domainnameprovder.cz.cc"; content:"|11|domainnameprovder|02|cz|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129221; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain domeafavour.ru"; content:"|0b|domeafavour|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129222; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain down.adobe-updates.net"; content:"|04|down|0d|adobe-updates|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129223; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain drontapesoff.com"; content:"|0c|drontapesoff|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129224; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dst-finance.com"; content:"|0b|dst-finance|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129225; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain duowork.kz"; content:"|07|duowork|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129226; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain dvsdfvsw.narod2.ru"; content:"|08|dvsdfvsw|06|narod2|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129227; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain e-exchanger.ir"; content:"|0b|e-exchanger|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129228; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain earlyship.ru"; content:"|09|earlyship|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129229; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ecommerceone.ru"; content:"|0c|ecommerceone|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129230; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain edgecube.com"; content:"|08|edgecube|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129231; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eepeohothe.ru"; content:"|0a|eepeohothe|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129232; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eewqr12.servebeer.com"; content:"|07|eewqr12|09|servebeer|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129233; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ematome.com"; content:"|07|ematome|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129234; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain eperonquiberon.fr"; content:"|0e|eperonquiberon|02|fr"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129235; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain esperadooptic.ru"; content:"|0d|esperadooptic|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129236; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain espmexusa.ru"; content:"|09|espmexusa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129237; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain exp.exetsoft.org.ua"; content:"|03|exp|08|exetsoft|03|org|02|ua"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129238; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain expqlojkxytqp.biz"; content:"|0d|expqlojkxytqp|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129239; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain faasppouk.biz"; content:"|09|faasppouk|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129240; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fabsnot.ru"; content:"|07|fabsnot|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129241; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain face18.ru"; content:"|06|face18|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129242; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain faint.ir"; content:"|05|faint|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129243; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fastgoal.ru"; content:"|08|fastgoal|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129244; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fastnxtretrieval.com"; content:"|10|fastnxtretrieval|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129245; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fattree.ru"; content:"|07|fattree|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129246; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain favino.ru"; content:"|06|favino|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129247; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain favoritopilodjd.com"; content:"|0f|favoritopilodjd|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129248; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain federalreserve-online.com"; content:"|15|federalreserve-online|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129249; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain federetoktyt.net"; content:"|0c|federetoktyt|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129250; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fedralwire-report.com"; content:"|11|fedralwire-report|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129251; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain filebale.ru"; content:"|08|filebale|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129252; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fileservice.ir"; content:"|0b|fileservice|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129253; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain finans-group-global.ru"; content:"|13|finans-group-global|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129254; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain flashbangsecurity.com"; content:"|11|flashbangsecurity|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129255; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain florianarray.ru"; content:"|0c|florianarray|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129256; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain foresttest218999fhjslk.com.tw"; content:"|16|foresttest218999fhjslk|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129257; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain forppp.net"; content:"|06|forppp|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129258; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain forum4you.im"; content:"|09|forum4you|02|im"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129259; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fpzbox.com"; content:"|06|fpzbox|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129260; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain fred-c.com"; content:"|06|fred-c|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129261; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain freehost21.tw"; content:"|0a|freehost21|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129262; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain freshcomp.ir"; content:"|09|freshcomp|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129263; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain frtualpornclub.com"; content:"|0e|frtualpornclub|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129264; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ftwtogether.ru"; content:"|0b|ftwtogether|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129265; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain funtime.arvixe.ru"; content:"|07|funtime|06|arvixe|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129266; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain garati.it"; content:"|06|garati|02|it"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129267; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gerlsipslokane.su"; content:"|0e|gerlsipslokane|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129268; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ghostbustards.ru"; content:"|0d|ghostbustards|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129269; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ghosttrick.ru"; content:"|0a|ghosttrick|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129270; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain giftcanbuy.com"; content:"|0a|giftcanbuy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129271; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gigasoftware.ru"; content:"|0c|gigasoftware|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129272; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gloriandelorians.com"; content:"|10|gloriandelorians|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129273; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain go6po.biz"; content:"|05|go6po|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129274; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain godfix.ru"; content:"|06|godfix|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129275; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gorycup.ru"; content:"|07|gorycup|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129276; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gotoberlin.info"; content:"|0a|gotoberlin|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129277; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greathell.ru"; content:"|09|greathell|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129278; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain greatjazz.ru"; content:"|09|greatjazz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129279; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gugla.org"; content:"|05|gugla|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129280; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain gyodundena.hotmail.ru"; content:"|0a|gyodundena|07|hotmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129281; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain h21211.srv7.test-hf.ru"; content:"|06|h21211|04|srv7|07|test-hf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129282; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain haltermancelo.ru"; content:"|0d|haltermancelo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129283; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain heyitsme.ru"; content:"|08|heyitsme|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129284; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hhtres.com"; content:"|06|hhtres|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129285; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain high-privacy.com"; content:"|0c|high-privacy|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129286; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain high-update.com"; content:"|0b|high-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129287; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain high-upgrade.com"; content:"|0c|high-upgrade|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129288; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain highnetlifenet.com"; content:"|0e|highnetlifenet|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129289; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hnwxqurqjvynwljf.org"; content:"|10|hnwxqurqjvynwljf|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129290; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain holdaslas.so"; content:"|09|holdaslas|02|so"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129291; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hosthqk.net"; content:"|07|hosthqk|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129292; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hotupdaters.ru"; content:"|0b|hotupdaters|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129293; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hoycktsjwqsmklnv.biz"; content:"|10|hoycktsjwqsmklnv|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129294; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hselrurele.ru"; content:"|0a|hselrurele|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129295; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hunterdriveez.com"; content:"|0d|hunterdriveez|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129296; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain huntersamplifi.ru"; content:"|0e|huntersamplifi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129297; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain huntersrafters.ru"; content:"|0e|huntersrafters|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129298; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain hv673hv573hv53h7khv57.com"; content:"|15|hv673hv573hv53h7khv57|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129299; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain icredoname10012.com"; content:"|0f|icredoname10012|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129300; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iesnare.us"; content:"|07|iesnare|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129301; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ignis.net.ru"; content:"|05|ignis|03|net|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129302; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ilovekeks.biz"; content:"|09|ilovekeks|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129303; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain imamnhearte.hotmail.ru"; content:"|0b|imamnhearte|07|hotmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129304; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain inboxacc.com"; content:"|08|inboxacc|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129305; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain incode.name"; content:"|06|incode|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129306; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain indigocrickets.com"; content:"|0e|indigocrickets|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129307; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain indingo.ru"; content:"|07|indingo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129308; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain insane.ir"; content:"|06|insane|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129309; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain invest-club.info"; content:"|0b|invest-club|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129310; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain investriotinto.com"; content:"|0e|investriotinto|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129311; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ionicfood.ru"; content:"|09|ionicfood|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129312; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iopyte.bget.ru"; content:"|06|iopyte|04|bget|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129313; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iplatforma2020.ru"; content:"|0e|iplatforma2020|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129314; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iqservice.ir"; content:"|09|iqservice|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129315; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ironsum.ru"; content:"|07|ironsum|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129316; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain iserverupdates.com"; content:"|0e|iserverupdates|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129317; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ishopsystem.ru"; content:"|0b|ishopsystem|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129318; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain islenpiding.hotmail.ru"; content:"|0b|islenpiding|07|hotmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129319; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain itchyclock.ru"; content:"|0a|itchyclock|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129320; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain itchysauce.ru"; content:"|0a|itchysauce|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129321; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain itisagooddaytodie.ru"; content:"|11|itisagooddaytodie|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129322; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jad3.ru"; content:"|04|jad3|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129323; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jamesbondajent.ru"; content:"|0e|jamesbondajent|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129324; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jcmtczpwontvppnt.org"; content:"|10|jcmtczpwontvppnt|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129325; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jdjsaf34.com"; content:"|08|jdjsaf34|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129326; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jennifermusic.nl"; content:"|0d|jennifermusic|02|nl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129327; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jinanpharmaceutical.com"; content:"|13|jinanpharmaceutical|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129328; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jjustdoit.ru"; content:"|09|jjustdoit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129329; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jliqigsnggdwxp.org"; content:"|0e|jliqigsnggdwxp|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129330; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain johngottybest.com"; content:"|0d|johngottybest|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129331; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain johninjucy.ru"; content:"|0a|johninjucy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129332; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain joregen.mahostia.com"; content:"|07|joregen|08|mahostia|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129333; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain josunrwpyghvttr.com"; content:"|0f|josunrwpyghvttr|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129334; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain junioroops.name"; content:"|0a|junioroops|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129335; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain jupaizeuph.ru"; content:"|0a|jupaizeuph|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129336; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain just-ping.org"; content:"|09|just-ping|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129337; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain justbigtoyss.net"; content:"|0c|justbigtoyss|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129338; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kawabungashop.ru"; content:"|0d|kawabungashop|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129339; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kickthefuture.com"; content:"|0d|kickthefuture|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129340; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain klrtm.com"; content:"|05|klrtm|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129341; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kominas.com"; content:"|07|kominas|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129342; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kosmovodki.ru"; content:"|0a|kosmovodki|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129343; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain koukou.mine.nu"; content:"|06|koukou|04|mine|02|nu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129344; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain kupie-dlugi.pl"; content:"|0b|kupie-dlugi|02|pl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129345; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lameedge.ru"; content:"|08|lameedge|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129346; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain layeradv.com"; content:"|08|layeradv|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129347; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain leakyhero.ru"; content:"|09|leakyhero|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129348; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain legcold.ru"; content:"|07|legcold|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129349; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lesslane.ru"; content:"|08|lesslane|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129350; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain letstarting.ru"; content:"|0b|letstarting|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129351; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain level-upgrade.com"; content:"|0d|level-upgrade|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129352; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain level-upgrage.com"; content:"|0d|level-upgrage|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129353; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain liberweb.ru"; content:"|08|liberweb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129354; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain localdarcenss.com"; content:"|0d|localdarcenss|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129355; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain localh0st.info"; content:"|09|localh0st|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129356; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lostyear.ru"; content:"|08|lostyear|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129357; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lowerdog.ru"; content:"|08|lowerdog|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129358; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lprshcsmijfovp.com"; content:"|0e|lprshcsmijfovp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129359; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain luckersun.com"; content:"|09|luckersun|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129360; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain lwbbtfrtjjsyksl.biz"; content:"|0f|lwbbtfrtjjsyksl|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129361; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain m5ta2bq-server.net"; content:"|0e|m5ta2bq-server|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129362; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain makeitso.ru"; content:"|08|makeitso|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129363; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain makemealive.ru"; content:"|0b|makemealive|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129364; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain makemoneyonline.tk"; content:"|0f|makemoneyonline|02|tk"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129365; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain manageopoly.com"; content:"|0b|manageopoly|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129366; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain marmanjosurf.com.br"; content:"|0c|marmanjosurf|03|com|02|br"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129367; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mationsperohe.ru"; content:"|0d|mationsperohe|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129368; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain maymacngocphuong.com"; content:"|10|maymacngocphuong|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129369; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mcgoth.com"; content:"|06|mcgoth|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129370; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain media.https04.com"; content:"|05|media|07|https04|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129371; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain megashped.com"; content:"|09|megashped|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129372; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mibolyri.pisem.su"; content:"|08|mibolyri|05|pisem|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129373; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain michigan4movies.com"; content:"|0f|michigan4movies|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129374; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microbase-update.com"; content:"|10|microbase-update|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129375; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsoft-update.name"; content:"|10|microsoft-update|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129376; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain microsofto.sytes.net"; content:"|0a|microsofto|05|sytes|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129377; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain midbomb.ru"; content:"|07|midbomb|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129378; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mildruby.ru"; content:"|08|mildruby|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129379; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mildtune.ru"; content:"|08|mildtune|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129380; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain minihose.ru"; content:"|08|minihose|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129381; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain miniokoyokolia.su"; content:"|0e|miniokoyokolia|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129382; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain missboys.ru"; content:"|08|missboys|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129383; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain misssershmidt.ru"; content:"|0d|misssershmidt|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129384; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain moigerta.cn.com"; content:"|08|moigerta|02|cn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129385; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mokshark.com"; content:"|08|mokshark|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129386; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mswqvxohtpfnzj.org"; content:"|0e|mswqvxohtpfnzj|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129387; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain muchachoslot.ru"; content:"|0c|muchachoslot|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129388; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain munaeghohz.ru"; content:"|0a|munaeghohz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129389; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain myscarts.name"; content:"|08|myscarts|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129390; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain mz.u-gu.ru"; content:"|02|mz|04|u-gu|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129391; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nachauser-storeinfo.com"; content:"|13|nachauser-storeinfo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129392; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nachauserinfo.com"; content:"|0d|nachauserinfo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129393; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nahwisohch.ru"; content:"|0a|nahwisohch|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129394; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain namesservers.org"; content:"|0c|namesservers|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129395; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nastysmell.com"; content:"|0a|nastysmell|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129396; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain national-security-agency.com"; content:"|18|national-security-agency|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129397; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain natlalirans.hotmail.ru"; content:"|0b|natlalirans|07|hotmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129398; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain naughtywifepal.ru"; content:"|0e|naughtywifepal|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129399; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nearhog.ru"; content:"|07|nearhog|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129400; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain neironhounder.com"; content:"|0d|neironhounder|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129401; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdate1.ru"; content:"|0a|netupdate1|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129402; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdate4.ru"; content:"|0a|netupdate4|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129403; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdate5.ru"; content:"|0a|netupdate5|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129404; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdate8.ru"; content:"|0a|netupdate8|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129405; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdater.ru"; content:"|0a|netupdater|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129406; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdaters.ru"; content:"|0b|netupdaters|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129407; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdates.ru"; content:"|0a|netupdates|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129408; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain netupdatings.ru"; content:"|0c|netupdatings|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129409; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain newturbobrowser.com"; content:"|0f|newturbobrowser|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129410; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain newyaction.info"; content:"|0a|newyaction|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129411; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nicefilmsa.ru"; content:"|0a|nicefilmsa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129412; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain njxnerslmmvpyto.biz"; content:"|0f|njxnerslmmvpyto|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129413; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nookbizkitsad.com"; content:"|0d|nookbizkitsad|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129414; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain noseclan.ru"; content:"|08|noseclan|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129415; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain nuttyknack.ru"; content:"|0a|nuttyknack|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129416; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain objectsphereuf.com"; content:"|0e|objectsphereuf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129417; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ofigalidon.ru"; content:"|0a|ofigalidon|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129418; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oneant.ru"; content:"|06|oneant|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129419; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oneboy.ru"; content:"|06|oneboy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129420; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onemoretimehi.ru"; content:"|0d|onemoretimehi|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129421; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onepet.ru"; content:"|06|onepet|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129422; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain onlinereger.ru"; content:"|0b|onlinereger|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129423; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oposumschoone.com"; content:"|0d|oposumschoone|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129424; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oqkplss.com"; content:"|07|oqkplss|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129425; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain oqocbqmmmnnjzq.biz"; content:"|0e|oqocbqmmmnnjzq|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129426; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ourtulip.ru"; content:"|08|ourtulip|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129427; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ozoneiphone.ru"; content:"|0b|ozoneiphone|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129428; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain panelfretbbuiewnwdkhjg888333.com.tw"; content:"|1c|panelfretbbuiewnwdkhjg888333|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129429; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain papertulip.ru"; content:"|0a|papertulip|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129430; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pearlrumor.ru"; content:"|0a|pearlrumor|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129431; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pediwhena.nightmail.ru"; content:"|09|pediwhena|09|nightmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129432; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pellicslotersa.ru"; content:"|0e|pellicslotersa|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129433; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain petroleumgroup.biz"; content:"|0e|petroleumgroup|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129434; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain petromg.biz"; content:"|07|petromg|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129435; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pharirgatic.hotmail.ru"; content:"|0b|pharirgatic|07|hotmail|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129436; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain phoneajoystick.ru"; content:"|0e|phoneajoystick|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129437; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain photo-repair.ru"; content:"|0c|photo-repair|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129438; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain piecerack.ru"; content:"|09|piecerack|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129439; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pighair.ru"; content:"|07|pighair|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129440; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain plantlunch.ru"; content:"|0a|plantlunch|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129441; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pochemuchka.ir"; content:"|0b|pochemuchka|02|ir"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129442; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pogloro.com"; content:"|07|pogloro|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129443; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain poisk.su"; content:"|05|poisk|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129444; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain polovinkajfie.com"; content:"|0d|polovinkajfie|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129445; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain poogatodf.com"; content:"|09|poogatodf|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129446; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain popspostenkple.ru"; content:"|0e|popspostenkple|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129447; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain porno-mix-sex.com"; content:"|0d|porno-mix-sex|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129448; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain poste-secyre.com"; content:"|0c|poste-secyre|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129449; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain potvamp.ru"; content:"|07|potvamp|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129450; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pqgjpkeltfrrygoq.net"; content:"|10|pqgjpkeltfrrygoq|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129451; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pqrservrflmosqr.biz"; content:"|0f|pqrservrflmosqr|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129452; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain prlwppsunenofsx.com"; content:"|0f|prlwppsunenofsx|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129453; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ptichka.ru"; content:"|07|ptichka|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129454; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ptsoncmrusnjoew.com"; content:"|0f|ptsoncmrusnjoew|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129455; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain purecash.ru"; content:"|08|purecash|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129456; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain pyrohost.su"; content:"|08|pyrohost|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129457; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain qroslnnklpmcrmor.biz"; content:"|10|qroslnnklpmcrmor|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129458; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain quardsecurity.com"; content:"|0d|quardsecurity|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129459; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain queenchair.ru"; content:"|0a|queenchair|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129460; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain quiverforge.com"; content:"|0b|quiverforge|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129461; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain quiverharbor.com"; content:"|0c|quiverharbor|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129462; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain quiverwave.com"; content:"|0a|quiverwave|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129463; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain qwertyghost122245678.com"; content:"|14|qwertyghost122245678|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129464; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rabbitsgohole.ru"; content:"|0d|rabbitsgohole|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129465; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain radikal-ph0to.ru"; content:"|0d|radikal-ph0to|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129466; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain reflectivelayer.com"; content:"|0f|reflectivelayer|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129467; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rehandntersfee.ru"; content:"|0e|rehandntersfee|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129468; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain renowus.webatu.com"; content:"|07|renowus|06|webatu|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129469; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain renwoxing.me"; content:"|09|renwoxing|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129470; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain retyuloploples.net"; content:"|0e|retyuloploples|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129471; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain revercestable.com"; content:"|0d|revercestable|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129472; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rewriterform.com"; content:"|0c|rewriterform|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129473; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain roguefood.ru"; content:"|09|roguefood|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129474; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rogueroad.ru"; content:"|09|rogueroad|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129475; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rohacafe.com"; content:"|08|rohacafe|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129476; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rokqsjhzyiusvrj.info"; content:"|0f|rokqsjhzyiusvrj|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129477; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain roobshall.biz"; content:"|09|roobshall|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129478; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain routerstructo.ru"; content:"|0d|routerstructo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129479; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rt2.paydaylloans.ru"; content:"|03|rt2|0c|paydaylloans|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129480; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain rudeink.ru"; content:"|07|rudeink|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129481; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain runnystorm.ru"; content:"|0a|runnystorm|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129482; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ruvehedo.webatu.com"; content:"|08|ruvehedo|06|webatu|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129483; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sampinv.name"; content:"|07|sampinv|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129484; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sarjnessfundof.su"; content:"|0e|sarjnessfundof|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129485; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sc00d.webatu.com"; content:"|05|sc00d|06|webatu|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129486; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain scarts.name"; content:"|06|scarts|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129487; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain scooter.web.tr"; content:"|07|scooter|03|web|02|tr"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129488; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sdkjgndfjnf.ru"; content:"|0b|sdkjgndfjnf|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129489; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain seawoljoystick.ru"; content:"|0e|seawoljoystick|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129490; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain secondconcert.ru"; content:"|0d|secondconcert|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129491; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain secureserfingnet.ru"; content:"|10|secureserfingnet|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129492; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain securitydaemon.com"; content:"|0e|securitydaemon|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129493; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain seeikom.name"; content:"|07|seeikom|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129494; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sellertop.cn.com"; content:"|09|sellertop|02|cn|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129495; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain serva4ok.server2.eu"; content:"|08|serva4ok|07|server2|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129496; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain servicespaypal.be"; content:"|0e|servicespaypal|02|be"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129497; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain setuxole.webatu.com"; content:"|08|setuxole|06|webatu|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129498; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sfimnakedgirls.com"; content:"|0e|sfimnakedgirls|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129499; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sgy.ru"; content:"|03|sgy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129500; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shikalmuna.com"; content:"|0a|shikalmuna|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129501; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shokoladdeath.ru"; content:"|0d|shokoladdeath|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129502; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain shopingplace.org"; content:"|0c|shopingplace|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129503; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sickstage.ru"; content:"|09|sickstage|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129504; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain siimplesale.ru"; content:"|0b|siimplesale|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129505; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain simplychasinasis.com"; content:"|10|simplychasinasis|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129506; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain simulatormage.ru"; content:"|0d|simulatormage|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129507; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain skiangpa.net"; content:"|08|skiangpa|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129508; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain skykeyboard2.ru"; content:"|0c|skykeyboard2|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129509; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smartcheat.ru"; content:"|0a|smartcheat|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129510; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smartsecurityadvizor.com"; content:"|14|smartsecurityadvizor|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129511; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smartsecuritybox.com"; content:"|10|smartsecuritybox|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129512; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain smokybear.ru"; content:"|09|smokybear|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129513; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain snaretrace.us"; content:"|0a|snaretrace|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129514; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain snaretrack.biz"; content:"|0a|snaretrack|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129515; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain snarework.us"; content:"|09|snarework|02|us"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129516; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain snotarms.ru"; content:"|08|snotarms|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129517; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain softmarket-drom.ru"; content:"|0f|softmarket-drom|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129518; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain softmarkets.ru"; content:"|0b|softmarkets|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129519; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain softsecuritylab.com"; content:"|0f|softsecuritylab|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129520; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain soretag.ru"; content:"|07|soretag|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129521; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sox.kz"; content:"|03|sox|02|kz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129522; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain spl.kerrq.com"; content:"|03|spl|05|kerrq|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129523; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ssss.everywebspace.com"; content:"|04|ssss|0d|everywebspace|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129524; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stacyeiblerki.com"; content:"|0d|stacyeiblerki|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129525; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain staticplan.ru"; content:"|0a|staticplan|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129526; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain statserver.admin163biz.ru"; content:"|0a|statserver|0b|admin163biz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129527; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain steelcinetecs.ru"; content:"|0d|steelcinetecs|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129528; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain steelstorm.su"; content:"|0a|steelstorm|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129529; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stfuthesims.ru"; content:"|0b|stfuthesims|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129530; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain stripsneko.ru"; content:"|0a|stripsneko|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129531; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain strongtopguard.com"; content:"|0e|strongtopguard|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129532; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain styleforyour.ru"; content:"|0c|styleforyour|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129533; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain sundaymold.ru"; content:"|0a|sundaymold|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129534; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain svjazbila.ru"; content:"|09|svjazbila|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129535; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain svjazinet.ru"; content:"|09|svjazinet|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129536; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain taemaidoo.com"; content:"|09|taemaidoo|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129537; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain teculek.hostzi.com"; content:"|07|teculek|06|hostzi|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129538; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain telefonchukcha.ru"; content:"|0e|telefonchukcha|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129539; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain telelope.com"; content:"|08|telelope|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129540; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain test444for555test333.com.tw"; content:"|14|test444for555test333|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129541; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testeradminpanel222777.com.tw"; content:"|16|testeradminpanel222777|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129542; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testfhjtestpanel2226333.com.tw"; content:"|17|testfhjtestpanel2226333|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129543; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testfortestltd444557.com.tw"; content:"|14|testfortestltd444557|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129544; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testing1testing2fhj3888222.com.tw"; content:"|1a|testing1testing2fhj3888222|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129545; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testingdomainforfhj2220001.com.tw"; content:"|1a|testingdomainforfhj2220001|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129546; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testingforg00gle777245.com.tw"; content:"|16|testingforg00gle777245|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129547; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testingforinnovation2221999.com.tw"; content:"|1b|testingforinnovation2221999|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129548; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testinglightversion999111.com.tw"; content:"|19|testinglightversion999111|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129549; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testonlyforfhj3355591.com.tw"; content:"|15|testonlyforfhj3355591|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129550; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testtestforfhj111998.com.tw"; content:"|14|testtestforfhj111998|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129551; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testtestingpotatoes111222.com.tw"; content:"|19|testtestingpotatoes111222|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129552; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain testtexttost555888.com.tw"; content:"|12|testtexttost555888|03|com|02|tw"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129553; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tg2000.ru"; content:"|06|tg2000|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129554; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain theddos.me"; content:"|07|theddos|02|me"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129555; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thelookaround.net.atservers.net"; content:"|0d|thelookaround|03|net|09|atservers|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129556; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain thescarts.name"; content:"|09|thescarts|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129557; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain theshop.su"; content:"|07|theshop|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129558; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tixuanabridge.ru"; content:"|0d|tixuanabridge|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129559; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain toloveornottolove.ipq.co"; content:"|11|toloveornottolove|03|ipq|02|co"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129560; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain toplake.ru"; content:"|07|toplake|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129561; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain topsecurityplace.com"; content:"|10|topsecurityplace|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129562; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain topupdate.ru"; content:"|09|topupdate|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129563; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain topupdater.ru"; content:"|0a|topupdater|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129564; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain topupdaters.ru"; content:"|0b|topupdaters|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129565; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tor4ok.com"; content:"|06|tor4ok|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129566; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain totalexcel.net"; content:"|0a|totalexcel|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129567; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain toxicyack.ru"; content:"|09|toxicyack|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129568; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain track.wwwapps-ups.net"; content:"|05|track|0b|wwwapps-ups|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129569; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tradingcenter.cc"; content:"|0d|tradingcenter|02|cc"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129570; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain traveltomexixo.ru"; content:"|0e|traveltomexixo|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129571; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trezvostida.ru"; content:"|0b|trezvostida|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129572; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trigaproholds.com"; content:"|0d|trigaproholds|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129573; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain triplexguard.com"; content:"|0c|triplexguard|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129574; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain troj.zx9.de"; content:"|04|troj|03|zx9|02|de"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129575; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trucktrumpet.com"; content:"|0c|trucktrumpet|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129576; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain truststats.ru"; content:"|0a|truststats|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129577; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain trutofmymemory.su"; content:"|0e|trutofmymemory|02|su"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129578; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tscounter.com"; content:"|09|tscounter|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129579; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tuk-tuk.com"; content:"|07|tuk-tuk|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129580; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tunepage.ru"; content:"|08|tunepage|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129581; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tunisianowar.ru"; content:"|0c|tunisianowar|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129582; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain turkeyinworld.ru"; content:"|0d|turkeyinworld|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129583; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain tventinypoloret.com"; content:"|0f|tventinypoloret|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129584; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ufkirankmega.net"; content:"|0c|ufkirankmega|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129585; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uilveropoly.com"; content:"|0b|uilveropoly|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129586; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ukadevochka.ru"; content:"|0b|ukadevochka|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129587; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uklopandaberk.ru"; content:"|0d|uklopandaberk|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129588; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ultimatesecurity.info"; content:"|10|ultimatesecurity|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129589; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ultrareservation.com"; content:"|10|ultrareservation|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129590; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ultrawirereservation.com"; content:"|14|ultrawirereservation|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129591; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain underfeet.ru"; content:"|09|underfeet|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129592; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain united-trans.org"; content:"|0c|united-trans|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129593; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain upserv74912.com"; content:"|0b|upserv74912|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129594; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uptonxtwealth.com"; content:"|0d|uptonxtwealth|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129595; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uralgaz.ru"; content:"|07|uralgaz|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129596; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain uskamalchik.ru"; content:"|0b|uskamalchik|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129597; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vampkeys.ru"; content:"|08|vampkeys|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129598; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vardington7.ru"; content:"|0b|vardington7|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129599; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vastcoins.ru"; content:"|09|vastcoins|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129600; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vensart.net"; content:"|07|vensart|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129601; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain viimans.com"; content:"|07|viimans|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129602; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain villiam-grea.ru"; content:"|0c|villiam-grea|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129603; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain viperos.ru"; content:"|07|viperos|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129604; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vipworldhost.com"; content:"|0c|vipworldhost|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129605; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain voizhest.net"; content:"|08|voizhest|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129606; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vseponovoy.cc.im"; content:"|0a|vseponovoy|02|cc|02|im"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129607; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vvmmp.ru"; content:"|05|vvmmp|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129608; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain vzrnb4o4.com"; content:"|08|vzrnb4o4|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129609; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain waercomendsrard9zara.com"; content:"|14|waercomendsrard9zara|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129610; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wahaqab.mahostia.com"; content:"|07|wahaqab|08|mahostia|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129611; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain warynews.ru"; content:"|08|warynews|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129612; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wdoyqoxnmmrlqyot.biz"; content:"|10|wdoyqoxnmmrlqyot|03|biz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129613; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain weaktrash.ru"; content:"|09|weaktrash|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129614; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wearysnake.ru"; content:"|0a|wearysnake|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129615; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain webanalyses.com"; content:"|0b|webanalyses|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129616; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain webanalyticsrecord.com"; content:"|12|webanalyticsrecord|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129617; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain westernillusion.com"; content:"|0f|westernillusion|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129618; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain westfight.ru"; content:"|09|westfight|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129619; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wewstfnnsjnjisq.com"; content:"|0f|wewstfnnsjnjisq|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129620; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain whyvavilon.com"; content:"|0a|whyvavilon|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129621; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain widowadvertising.net"; content:"|10|widowadvertising|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129622; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wiedemannlawfirm.com"; content:"|10|wiedemannlawfirm|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129623; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wildboy.ru"; content:"|07|wildboy|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129624; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain winner-bets.ru"; content:"|0b|winner-bets|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129625; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wisework.orge.pl"; content:"|08|wisework|04|orge|02|pl"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129626; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain witlion.ru"; content:"|07|witlion|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129627; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain woodwit.ru"; content:"|07|woodwit|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129628; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain woodyalternative.ns1.name"; content:"|10|woodyalternative|03|ns1|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129629; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain woodyalternative2.ns1.name"; content:"|11|woodyalternative2|03|ns1|04|name"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129630; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wopedjhfntzfgh.com"; content:"|0e|wopedjhfntzfgh|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129631; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wsqwehnnjppxrgxp.org"; content:"|10|wsqwehnnjppxrgxp|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129632; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain wuvwqckpzfxrqi.org"; content:"|0e|wuvwqckpzfxrqi|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129633; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.360chiro.net"; content:"|03|www|08|360chiro|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129634; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.aleph3.eu"; content:"|03|www|06|aleph3|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129635; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.amanda-church.com"; content:"|03|www|0d|amanda-church|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129636; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.apel.it"; content:"|03|www|04|apel|02|it"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129637; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.artmetal.cz"; content:"|03|www|08|artmetal|02|cz"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129638; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.asa-designs.com"; content:"|03|www|0b|asa-designs|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129639; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.biliardispampinato.it"; content:"|03|www|12|biliardispampinato|02|it"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129640; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.caserow.ru"; content:"|03|www|07|caserow|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129641; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.clicbenin.net"; content:"|03|www|09|clicbenin|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129642; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.ctipiramida.ru"; content:"|03|www|0b|ctipiramida|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129643; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.easilypaydayloan.com"; content:"|03|www|10|easilypaydayloan|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129644; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.enexus.it"; content:"|03|www|06|enexus|02|it"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129645; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.escrow-int-ltd.com"; content:"|03|www|0e|escrow-int-ltd|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129646; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.fundateideas.org"; content:"|03|www|0c|fundateideas|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129647; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.ig-seniorensport.at"; content:"|03|www|10|ig-seniorensport|02|at"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129648; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.king-brian.com"; content:"|03|www|0a|king-brian|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129649; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.omniaimmobiliare.com"; content:"|03|www|10|omniaimmobiliare|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129650; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.sangiuseppepirri.eu"; content:"|03|www|10|sangiuseppepirri|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129651; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.sensotek-spa.com"; content:"|03|www|0c|sensotek-spa|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129652; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.strbrst.net"; content:"|03|www|07|strbrst|03|net"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129653; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain www.totaweb.com"; content:"|03|www|07|totaweb|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129654; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xaz6g1bc-server.com"; content:"|0f|xaz6g1bc-server|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129655; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xlamonline.ru"; content:"|0a|xlamonline|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129656; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xldavinchireverce.com"; content:"|11|xldavinchireverce|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129657; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xlreservation.com"; content:"|0d|xlreservation|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129658; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xoophafiel.ru"; content:"|0a|xoophafiel|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129659; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xpubblicita.com"; content:"|0b|xpubblicita|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129660; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xtrace-upgrade.com"; content:"|0e|xtrace-upgrade|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129661; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xxmagicreservation.com"; content:"|12|xxmagicreservation|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129662; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain xxxmagicreservation.com"; content:"|13|xxxmagicreservation|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129663; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yefuwuq.mahostia.com"; content:"|07|yefuwuq|08|mahostia|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129664; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ygnlgxyzamfxvlt.info"; content:"|0f|ygnlgxyzamfxvlt|04|info"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129665; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ymlo.eu"; content:"|04|ymlo|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129666; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain youdontfkjbaher.ru"; content:"|0f|youdontfkjbaher|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129667; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain youngmetal.ru"; content:"|0a|youngmetal|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129668; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yourtulip.ru"; content:"|09|yourtulip|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129669; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ytjsxkupugwfppp.com"; content:"|0f|ytjsxkupugwfppp|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129670; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain ytpfmnmgyjinxrhe.com"; content:"|10|ytpfmnmgyjinxrhe|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129671; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yuelqmpimjxsmn.org"; content:"|0e|yuelqmpimjxsmn|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129672; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain yusenterminals.com"; content:"|0e|yusenterminals|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129673; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain z0rex.ru"; content:"|05|z0rex|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129674; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zaebiz.eu"; content:"|06|zaebiz|02|eu"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129675; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zanyquery.ru"; content:"|09|zanyquery|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129676; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zapppo1.org"; content:"|07|zapppo1|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129677; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zenhour.ru"; content:"|07|zenhour|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129678; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zlegalsource.com"; content:"|0c|zlegalsource|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129679; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zlen.ru"; content:"|04|zlen|02|ru"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129680; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zsearchweb.com"; content:"|0a|zsearchweb|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129681; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zwi.hostei.com"; content:"|03|zwi|06|hostei|03|com"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129682; rev:3;) alert udp !$DNS_SERVERS any -> any 53 (msg:"MALWARE Inside host looking for Trojan.Zeus domain zxz666.myftp.org"; content:"|06|zxz666|05|myftp|03|org"; nocase; tag: host,30,seconds,dst; classtype:trojan-activity; reference:url,zeustracker.abuse.ch/blocklist.php; sid:1129683; rev:3;)