PAW-PATRULES_MISC.rules

#                          KXK00OOkxxkO00KX0            
#                   ,NXKxo:,'...        ...';cdOXN:     
#                   l;. ..,:ldxkOOOOOOkkxol:,..  .o     
#                  dk  lOOOOOOkkkkkkkkkkkOOOOOOx  dk    
#              KNXOc. :0OkkkkkkkkkkkkkkkkkkkkkO0l. :kXNX
#              x. .'ckOOkkkkkkkkkkkookkkkkkkkkkOOOl,. .k
#              d. o0Okkkkkkkkkkkkk.   okkkkkkkkkkOO0k  x
#              l. c0kkkkkkko. .ckk    .kd..'xkkkkkk0x .o
#              ;, ;0kkkkkkkc    ;ko. .dk.   :kkkkkk0l ':
#              .l .OOkkkkkkkl. .lkocldkkl. 'xkkkkkOO, c.
#               l  o0kkkk:..'dkkk.    .;okkkkkkkkk0x  l 
#               .: .OOkkk;    xk,         .:kkkkkO0; ;. 
#                ;. :0kkkko;,cko            :kkkk0d .:  
#                 :  oOkkkkkkkk            .dkkk0k. :   
#                  :  dOkkkkkkk      .:odxkkkkkOk. ;    
#                   ;  oOkkkkkkx:,,ckkkkkkkkkkOx. ,     
#                    '. ;OOkkkkkkkkkkkkkkkkkOOc  '      
#                      ' .lOOkkkkkkkkkkkkkOOd. .        
#                        . .lOOkkkkkkkkkOOo' ..         
#                          ' .;dOOOkOOOx:. .            
#                            .. .,lxo;. ..              
#                                .. ..                  
#                                         
# ____   ___        __  ____       _              _           
#|  _ \ / \ \      / / |  _ \ __ _| |_ _ __ _   _| | ___  ___ 
#| |_) / _ \ \ /\ / /  | |_) / _` | __| '__| | | | |/ _ \/ __|
#|  __/ ___ \ V  V /   |  __/ (_| | |_| |  | |_| | |  __/\__ \
#|_| /_/   \_\_/\_/    |_|   \__,_|\__|_|   \__,_|_|\___||___/
#                                                             
# IDS Rules for Suricata
# 📜 Charles BLANC-ROLIN ⠵ - https://pawpatrules.fr - https://www.apssis.com - https://github.com/woundride
# Licence CC BY-NC-SA 4.0 : https://creativecommons.org/licenses/by-nc-sa/4.0/
# ℹ Misc
### Windows 10 ###
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🪟 Windows 10 version 21H2"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Windows NT 10.0"; fast_pattern; nocase; content:"10.0.0.0.19044"; nocase; reference:url,https://en.wikipedia.org/wiki/Windows_10_version_history; reference:url,https://endoflife.date/windows; metadata:created_at 2023_02_03, updated_at 2023_02_03; sid:3300733; rev:1; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🪟 Windows 10 version 22H2"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Windows NT 10.0"; fast_pattern; nocase; content:"10.0.0.0.19045"; nocase; reference:url,https://en.wikipedia.org/wiki/Windows_10_version_history; reference:url,https://endoflife.date/windows; metadata:created_at 2023_02_03, updated_at 2023_02_03; sid:3300734; rev:1; classtype:misc-activity;)
### Matériel ###
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Terminal de paiement bancaire 💳 Ingenico"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ja3_hash; content:"9526829084665ff8389b0e64c50a01ab"; metadata: former_category JA3; reference:url,https://www.ingenicoprepaid.com/nos-solutions/tpe/; metadata:created_at 2021_05_20, updated_at 2022_06_13; sid:3300735; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Terminal de paiement bancaire 💳 Ingenico"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ja3_hash; content:"d3c4c38594c134695a0a5541607bda7b"; metadata: former_category JA3; reference:url,https://www.ingenicoprepaid.com/nos-solutions/tpe/; metadata:created_at 2021_10_27, updated_at 2022_06_13; sid:3300736; rev:2; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Samsung / Hanwha Nework Video Recorder 📹⏺"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"update.websamsung.net"; nocase; http.user_agent; content:"Wget/"; nocase; http.uri; content:"NVR"; nocase; reference:url,https://www.hanwha-security.com/; metadata:created_at 2021_08_12, updated_at 2022_06_13; sid:3300737; rev:4; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Lexmark Printer 🖨"; flow:to_client, established; threshold: type limit, track by_src,count 1, seconds 86400; tls.cert_subject; content:"CN=ldc.lexmark.com"; nocase; reference:url,https://www.lexmark.com/; metadata:created_at 2021_11_12, updated_at 2022_06_13; sid:3300738; rev:4; classtype:misc-activity;)
alert tls $HOME_NET any -> any any (msg:"🐾 - ℹ Stormshield SNS Firewall 🧱 sandboxing feature enabled"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; fast_pattern; tls_sni; content:"sandboxing.stormshieldcs.eu"; reference:url,https://breachfighter.stormshieldcs.eu/; reference:url,https://www.stormshield.com/products-services/products/network-security/; metadata:created_at 2023_04_09 updated_at 2023_04_09; sid:3300739; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Stormshield SNS Firewall 🧱"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ja3.hash; content:"e119ca9b121b9e59a4a6c8610f14e61a"; fast_pattern; tls_sni; content:"-sns.stormshieldcs.eu"; nocase; endswith; reference:url,https://www.stormshield.com/products-services/products/network-security/; metadata:created_at 2023_04_09 updated_at 2023_04_15; sid:3300740; rev:5; classtype:misc-activity;)
### Solutions Anti-Virus / EDR ###
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Panda 🐼 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"AdminSecure PSInet"; nocase; reference:url,https://www.pandasecurity.com/en/support/card?id=40074; metadata:created_at 2021_07_12, updated_at 2022_06_13; sid:3300741; rev:5; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ F-Secure 🇫🇮 Antivirus 🛡"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=F-Secure Corporation"; nocase;  content:"L=Helsinki"; nocase; content:"C=FI"; nocase; content:"CN=doorman.sp.f-secure.com"; nocase; fast_pattern; reference:url,https://www.f-secure.com/; metadata:created_at 2021_07_14, updated_at 2023_12_27; sid:3300742; rev:8; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ McAfee 👾 Antivirus 🛡"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"CN=TrustedSourceServer_IMQA01"; nocase; reference:url,https://community.mcafee.com/t5/Endpoint-Security-ENS/Web-Control-Self-Signed-Certificate/m-p/638810/highlight/true#M5826; metadata:created_at 2021_07_20, updated_at 2022_06_13; sid:3300743; rev:3; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Avast 👾 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Avast"; nocase; reference:url,https://www.avast.com/; metadata:created_at 2021_07_28, updated_at 2022_06_13; sid:3300744; rev:11; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Kaspersky 🇷🇺 Antivirus 🛡"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Kaspersky"; nocase;  content:"L=Moscow"; nocase; content:"C=RU"; nocase; content:"CN=downloads.upd.kaspersky.com"; fast_pattern; nocase; reference:url,https://www.kaspersky.fr/; metadata:created_at 2021_07_29, updated_at 2022_10_21; sid:3300745; rev:3; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Kaspersky 🇷🇺 Antivirus 🛡"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Kaspersky Lab Switzerland GmbH"; nocase; content:"C=CH"; nocase; content:"CN=*.s.kaspersky-labs.com"; fast_pattern; nocase; reference:url,https://www.kaspersky.fr/; metadata:created_at 2022_10_21, updated_at 2022_10_21; sid:3300746; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Kaspersky 🇷🇺 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls_sni; content:"upd.kaspersky.com"; fast_pattern; nocase; reference:url,https://www.kaspersky.fr/; metadata:created_at 2022_10_21, updated_at 2022_10_21; sid:3300747; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Bitdefender 🇷🇴 Antivirus 🛡 Cloud Managed version (GravityZone Control Center)"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Bitdefender SRL"; nocase;  content:"L=Bucharest"; nocase; content:"C=RO"; nocase; content:"CN=*.gravityzone.bitdefender.com"; fast_pattern; nocase; reference:url,https://www.bitdefender.com/; metadata:created_at 2022_02_13, updated_at 2023_04_18; sid:3300748; rev:4; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Bitdefender 🇷🇴 Antivirus 🛡"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Bitdefender SRL"; nocase;  content:"L=Bucharest"; nocase; content:"C=RO"; nocase; content:"cdn.bitdefender.net"; fast_pattern; nocase; endswith; reference:url,https://www.bitdefender.com/; metadata:created_at 2023_04_18, updated_at 2023_04_18; sid:3300749; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ ClamAV 😈 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"database.clamav.net"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.clamav.net/; metadata:created_at 2022_02_13, updated_at 2022_06_13; sid:3300750; rev:3; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Sophos 🇬🇧 Antivirus 🛡 Cloud installer ⬇"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"sophosupd.com"; endswith; nocase; http.user_agent; content:"Sophos Cloud Installer"; fast_pattern; startswith; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_05_23 updated_at 2022_10_21; sid:3300751; rev:3; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Sophos 🇬🇧 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"sophosupd.com"; endswith; nocase; http.user_agent; content:"SophosUpdate"; startswith; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_05_23 updated_at 2022_06_13; sid:3300752; rev:2; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Sophos 🇬🇧 Antivirus 🛡"; flow:to_client, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls.cert_subject; content:"CN=*.sophosupd.com"; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_10_21 updated_at 2022_10_21; sid:3300753; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Sophos Home 🇬🇧 Antivirus 🛡"; flow:to_client, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls.cert_subject; content:"CN=s.home.sophos.com"; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_10_21 updated_at 2022_10_21; sid:3300754; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Sophos Home 🇬🇧 Antivirus 🛡"; flow:to_client, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls.cert_subject; content:"CN=accounts.home.sophos.com"; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_10_21 updated_at 2022_10_21; sid:3300755; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Sophos Home 🇬🇧 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:".home.sophos.com"; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_10_21 updated_at 2022_10_21; sid:3300756; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Sophos 🇬🇧 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"sophosupd.com"; nocase; reference:url,https://www.sophos.com/fr-fr/support/downloads; metadata:created_at 2022_10_21 updated_at 2022_10_21; sid:3300757; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Trend Micro 🇯🇵 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls_sni; content:".activeupdate.trendmicro.com"; fast_pattern; nocase; reference:url,https://www.trendmicro.com/; metadata:created_at 2022_10_21, updated_at 2022_10_21; sid:3300758; rev:1; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Trend Micro 🇯🇵 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"trendmicro.com"; http.user_agent; content:"TMUFE"; reference:url,https://www.trendmicro.com/; metadata:created_at 2022_10_21, updated_at 2022_10_21; sid:3300759; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Trend Micro 🇯🇵 Antivirus 🛡"; flow:to_server, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls_sni; content:".icrc.trendmicro.com"; fast_pattern; nocase; reference:url,https://www.trendmicro.com/; metadata:created_at 2022_10_21, updated_at 2022_10_21; sid:3300760; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Avira 🇩🇪 Antivirus 🛡"; flow:to_client, established; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"O=Avira Operations GmbH"; nocase; content:"C=DE"; nocase; content:"CN=dispatch.avira-update.com"; fast_pattern; nocase; reference:url,https://www.avira.com/fr/; metadata:created_at 2023_06_04, updated_at 2023_06_04; sid:3300761; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ SentinelOne 🇮🇱 🇺🇸 Endpoint agent 🛡 for 🪟 Windows 11"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; ja3.hash; content:"6a5d235ee78c6aede6a61448b4e9ff1e"; fast_pattern; tls_sni; content:"sentinelone.net"; nocase; endswith; reference:url,https://www.sentinelone.com; metadata:created_at 2023_12_27, updated_at 2024_01_25; sid:3301100; rev:3; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ SentinelOne 🇮🇱 🇺🇸 Endpoint agent 🛡 for 🪟 Windows 10"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; ja3.hash; content:"3b5074b1b5d032e5620f69f9f700ff0e"; fast_pattern; tls_sni; content:"sentinelone.net"; nocase; endswith; reference:url,https://www.sentinelone.com; metadata:created_at 2024_01_22, updated_at 2024_01_25; sid:3301123; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Wazuh Open Source XDR agent for Windows 🪟 download ⬇"; flow:to_server, stateless; tls_sni; content:"packages.wazuh.com"; endswith; nocase; reference:url,https://wazuh.com/; metadata:created_at 2024_05_26, updated_at 2024_05_26; sid:3321269; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> any 1515 (msg:"🐾 - ℹ Wazuh XDR agent for Windows 🪟 > Server enrollment"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.3; ja3.hash; content:"befadf104471be7e62eb22b872cd74b6"; reference:url,https://wazuh.com/; metadata:created_at 2024_05_26, updated_at 2024_05_29; sid:3321270; rev:4; classtype:misc-activity;)
### Clients VPN ##
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Fortinet VPN Client 🧱 installer / updater for 🪟 Windows"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"compatible|3B| FCT"; nocase; reference:url,https://www.fortinet.com/support/product-downloads; metadata:created_at 2021_05_27, updated_at 2023_04_17; sid:3300762; rev:6; classtype:misc-activity;)
alert ip any any -> any any (msg:"🐾 - ℹ VPN L2TP Windows Client 🧱"; threshold: type limit, track by_src,count 1, seconds 86400; content:"26244d38eddb61b3172a36e3d0cfb819"; nocase; content:"1e2b516905991c7d7c96fcbfb587e46100000009"; nocase; content:"01528bbbc00696121849ab9a1c5b2a5100000001"; nocase; metadata:created_at 2022_05_13, updated_at 2022_05_16; sid:3300763; rev:5; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ FortiClient VPN 🧱"; flow:to_client, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; tls.cert_subject; content:"CN=globalupdate.fortinet.net"; nocase; fast_pattern; content:"|4f 3d 46 6f 72 74 69 6e 65 74 2c 20 49 6e 63 2e|"; content:"L=Sunnyvale"; nocase; content:"ST=California"; nocase; content:" C=US"; nocase; reference:url,https://www.fortinet.com/support/product-downloads; metadata:created_at 2023_03_12 updated_at 2023_03_12; sid:3300764; rev:1; classtype:misc-activity;)

### Applications ###
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Autodesk - Logiciel de conception 🏢 "; flow:to_client, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"C=US"; nocase; content:"ST=California"; nocase; content:"L=San Rafael"; nocase; content:"O=Autodesk"; nocase; content:"CN=ase.autodesk.com"; nocase; reference:url,https://www.autodesk.fr/; metadata:created_at 2021_07_20, updated_at 2022_06_15; sid:3300765; rev:4; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Greenshot 📸 Screenshot utility for Windows"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"getgreenshot.org"; nocase; http.uri; content:"project-feed"; nocase; reference:url,https://greenshot.org/; metadata:created_at 2021_08_05, updated_at 2022_06_13; sid:3300766; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Notepad++ 🗒 on Windows 🪟"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"notepad-plus-plus.org"; nocase; ja3.hash; content:"3b5074b1b5d032e5620f69f9f700ff0e"; reference:url,https://notepad-plus-plus.org/; metadata:created_at 2021_08_05, updated_at 2023_04_17; sid:3300767; rev:7; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Notepad++ 🗒 on Linux Wine 🍷🐧"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"notepad-plus-plus.org"; nocase; ja3.hash; content:"a35a8948ef1262d99ac83ac1a61a40fd"; reference:url,https://notepad-plus-plus.org/; metadata:created_at 2023_04_17, updated_at 2023_04_17; sid:3300768; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ PDF Creator / PDF Architect 📙"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"pdfarchitect.org"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.pdfforge.org/pdfarchitect; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300769; rev:9; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Chamilo 🦎 - Elearning Platform 👨‍🏫"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"version.chamilo.org"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://chamilo.org/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300770; rev:8; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ PhpMyAdmin 🗃 - Curl Update"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"www.phpmyadmin.net"; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.phpmyadmin.net/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300771; rev:7; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ GLPI 🖥🎟"; flow:to_server, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls_sni; content:"services.glpi-network.com"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://glpi-project.org/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300772; rev:6; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ VMware Software 🖥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"softwareupdate.vmware.com"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.vmware.com/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300773; rev:6; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ VMware Software 🖥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"softwareupdate.vmware.com"; nocase; ja3.hash; content:"a7dfa1673bb090cab6b6658861f43473"; reference:url,https://www.vmware.com/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300774; rev:7; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ VMware Software 🖥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"vcsa.vmware.com"; nocase; ja3.hash; content:"a7dfa1673bb090cab6b6658861f43473"; reference:url,https://www.vmware.com/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300775; rev:8; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Wikimedia Platform 📖"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"meta.wikimedia.org"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.wikimedia.org/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300776; rev:7; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Blue Iris 📹 Video Security 👮 - ⚠ Possible leak in URL"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"blueirissoftware.com"; nocase; http.user_agent; content:"compatible|3B| MSIE 8.0|3B| Windows NT 5.1|3B| Trident/4.0"; nocase; reference:url,https://blueirissoftware.com/; metadata:created_at 2021_08_12, updated_at 2022_06_15; sid:3300777; rev:6; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Composer - Dependency Manager for PHP 👨‍🏫"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"getcomposer.org"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://getcomposer.org/; metadata:created_at 2021_08_13, updated_at 2022_06_15; sid:3300778; rev:4; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ TP-Link IOT 🤖"; flow:to_client, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"CN=*.i.tplinknbu.com"; nocase; reference:url,https://www.tp-link.com/; metadata:created_at 2021_08_13, updated_at 2022_06_15; sid:3300779; rev:3; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ PRTG Network Monitoring 👀"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"updatecheck.paessler.com"; nocase; reference:url,https://www.paessler.com/; metadata:created_at 2021_08_18, updated_at 2022_06_15; sid:3300780; rev:2; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Virtualbox 🖥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"download.virtualbox.org"; nocase; http.user_agent; content:"CcfDownload/"; nocase; reference:url,https://www.virtualbox.org/; metadata:created_at 2021_08_26, updated_at 2022_06_15; sid:3300781; rev:5; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Acronis Agent 🛡"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ja3_hash; content:"6825b330bf9de50ccc8745553cb61b2f"; metadata: former_category JA3; reference:url,https://www.acronis.com/; metadata:created_at 2021_09_09, updated_at 2024_04_29; sid:3300782; rev:3; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Synology NAS 💽"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"pkgupdate.synology.com"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.synology.com/; metadata:created_at 2021_09_11, updated_at 2022_06_15; sid:3300783; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Soda PDF 📝"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"sodapdf.com"; nocase; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; reference:url,https://www.sodapdf.com/; metadata:created_at 2021_09_29, updated_at 2022_06_15; sid:3300784; rev:3; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ GNOME 👣 GUI - Linux System 🐧"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"extensions.gnome.org"; nocase; ja3.hash; content:"8d9f7747675e24454cd9b7ed35c58707"; reference:url,https://www.gnome.org/; metadata:created_at 2022_02_13, updated_at 2022_06_15; sid:3300785; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Lenovo 💻 computer update"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"filedownload.lenovo.com"; nocase; ja3.hash; content:"54328bd36c14bd82ddaa0c04b25ed9ad"; reference:url,https://www.lenovo.com/; metadata:created_at 2022_02_14, updated_at 2022_06_15; sid:3300786; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Signal Spam 🎣 📧 Plugin"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"vrf01.signal-spam.fr"; nocase; reference:url,https://www.signal-spam.fr/; metadata:created_at 2022_02_14, updated_at 2022_06_15; sid:3300787; rev:2; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Thunderbird 🕊 Email client 📧"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Mozilla/5.0"; nocase; content:"Thunderbird/"; nocase; reference:url,https://www.thunderbird.net/; metadata:created_at 2022_02_14, updated_at 2022_06_15; sid:3300788; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Slack 💬 client for Windows"; flow:to_server, stateless;threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"slack.com"; nocase; ja3.hash; content:"598872011444709307b861ae817a4b60"; reference:url,https://slack.com/intl/fr-fr/downloads/windows; metadata:created_at 2022_02_15, updated_at 2022_06_15; sid:3300789; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Discord 💬 client"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"gateway.discord.gg"; nocase; reference:url,https://discordapp.com/; metadata:created_at 2022_02_15, updated_at 2022_06_15; sid:3300790; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Bleachbit 🧽"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"update.bleachbit.org"; nocase; reference:url,https://www.bleachbit.org/; metadata:created_at 2022_02_18, updated_at 2022_06_15; sid:3300791; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Zoom 📹 client for Windows"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"zoom.us"; nocase; ja3.hash; content:"10f1ebcdc5bf282bdf4aec39fb4cfc8b"; reference:url,https://zoom.us/; metadata:created_at 2022_03_10, updated_at 2022_06_15; sid:3300792; rev:5; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Zoom 📹 client for Windows"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"zoom.us"; nocase; ja3.hash; content:"a11b4490e00d7eb15e01133674ccc829"; reference:url,https://zoom.us/; metadata:created_at 2022_07_20, updated_at 2022_07_20; sid:3300793; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Linux 🐧 Vendor Firmware Service"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"cdn.fwupd.org"; nocase; reference:url,https://fwupd.org/; metadata:created_at 2022_03_14, updated_at 2022_06_15; sid:3300794; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Virtualbox 🖥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"update.virtualbox.org"; nocase; reference:url,https://www.virtualbox.org/; metadata:created_at 2022_03_18, updated_at 2022_06_15; sid:3300795; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Virtualbox 🖥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"download.virtualbox.org"; nocase; reference:url,https://www.virtualbox.org/; metadata:created_at 2022_03_18, updated_at 2022_06_15; sid:3300796; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Tchap 💬 🇫🇷 national IM"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"matrix.agent.externe.tchap.gouv.fr"; nocase; reference:url,https://www.tchap.gouv.fr/; metadata:created_at 2022_03_18, updated_at 2022_06_15; sid:3300797; rev:3; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Slack 💬 mobile application"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"wss-mobile.slack.com"; nocase; reference:url,https://slack.com/intl/fr-fr/downloads/; metadata:created_at 2022_03_18, updated_at 2022_06_15; sid:3300798; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Linux 🐧 Snapcraft API"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"api.snapcraft.io"; nocase; reference:url,https://snapcraft.io/; metadata:created_at 2022_05_24, updated_at 2022_06_15; sid:3300799; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ uBlock Origin 🛡 Web browser ad content blocker Plugin"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"ublockorigin.pages.dev"; nocase; reference:url,https://ublockorigin.com/; metadata:created_at 2022_06_13, updated_at 2022_06_13; sid:3300800; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ uBlock Origin 🛡 Web browser ad content blocker Plugin"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"ublockorigin.github.io"; nocase; reference:url,https://ublockorigin.com/; metadata:created_at 2022_06_13, updated_at 2022_06_13; sid:3300801; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Adobe Acrobat - PDF Reader 📙"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:".adobe.com"; nocase; ja3.hash; content:"ce5f3254611a8c095a3d821d44539877"; reference:url,https://www.adobe.com/acrobat/pdf-reader.html; metadata:created_at 2022_07_13, updated_at 2022_07_13; sid:3300802; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Asustor NAS 💽"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:".asustor.com"; nocase; ja3.hash; content:"fb4726d465c5f28b84cd6d14cedd13a7"; reference:url,https://www.asustor.com/; metadata:created_at 2022_07_14, updated_at 2022_07_14; sid:3300803; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Microsoft Office 365 📘"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"ocws.officeapps.live.com"; nocase; ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1"; reference:url,https://www.office.com/; metadata:created_at 2022_07_22, updated_at 2022_08_09; sid:3300804; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Microsoft Windows 🪟 Dr Watson 👨‍⚕️ debugger enabled"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"watson.telemetry.microsoft.com"; nocase; ja3.hash; content:"ce5f3254611a8c095a3d821d44539877"; reference:url,https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/disable-enable-dr-watson-program; metadata:created_at 2022_07_22, updated_at 2022_07_22; sid:3300805; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Libre Office 📗"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"update.libreoffice.org"; nocase; reference:url,https://www.libreoffice.org/; metadata:created_at 2022_08_09, updated_at 2022_08_09; sid:3300806; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Youtube-DL 📺 📥 possible"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 3600; ssl_version:tls1.3; tls_sni; content:".googlevideo.com"; nocase; ja3.hash; content:"c199b43d41b470f8f68c5561f8f1ce3e"; fast_pattern; reference:url,https://youtube-dl.org/; metadata:created_at 2023_01_29, updated_at 2023_02_03; sid:3300807; rev:2; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ VLC Media Player 🎬"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"update.videolan.org"; endswith; fast_pattern; http.user_agent; content:"VLC/"; nocase; reference:url,https://www.videolan.org/; metadata:created_at 2023_02_03, updated_at 2023_02_21; sid:3300808; rev:2; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ OpenShot Video 📼 Editor ▶"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"openshot.org"; endswith; fast_pattern; http.user_agent; content:"openshot-qt"; nocase; reference:url,https://www.openshot.org; metadata:created_at 2023_02_03, updated_at 2023_02_21; sid:3300809; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Vokoscreen NG 🖥️ Screencast ⏺"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 3600; ssl_version:tls1.3; tls_sni; content:"vokoscreen.volkoh.de"; endswith; nocase; ja3.hash; content:"57fbe0aefee44901190849b0e877a5e1"; fast_pattern; reference:url,https://linuxecke.volkoh.de/vokoscreen/vokoscreen.html; metadata:created_at 2023_02_03, updated_at 2023_02_21; sid:3300810; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Vokoscreen NG 🖥️ Screencast ⏺"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 3600; ssl_version:tls1.3; tls_sni; content:"vokoscreen.volkoh.de"; endswith; nocase; ja3.hash; content:"0401c0b25dff8b94bcb822b4b2e6d75b"; fast_pattern; reference:url,https://linuxecke.volkoh.de/vokoscreen/vokoscreen.html; metadata:created_at 2024_06_01, updated_at 2024_06_01; sid:3321276; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ GIMP 📸 for Linux 🐧"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 3600; ssl_version:tls1.3; tls_sni; content:"www.gimp.org"; endswith; nocase; ja3.hash; content:"0d3fcf6999f33c6af23278bf162455d8"; fast_pattern; reference:url,https://www.gimp.org/; metadata:created_at 2023_02_26, updated_at 2023_02_26; sid:3300811; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ GIMP 📸 for Windows 🪟"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 3600; tls_sni; content:"www.gimp.org"; endswith; nocase; ja3.hash; content:"a0e9f5d64349fb13191bc781f81f42e1"; fast_pattern; reference:url,https://www.gimp.org/; metadata:created_at 2023_02_26, updated_at 2023_11_20; sid:3300812; rev:2; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Microsoft Teams 📘📅📞🎥"; flow:to_client, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"C=US"; nocase; content:"ST=WA"; nocase; content:"L=Redmond"; nocase; content:"O=Microsoft Corporation"; nocase; content:"CN=*.trouter.teams.microsoft.com"; nocase; fast_pattern; reference:url,https://www.microsoft.com/en-us/microsoft-teams/group-chat-software; metadata:created_at 2023_03_15, updated_at 2023_03_15; sid:3300813; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Apple 🍏 device connected on the network"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"cl"; pcre:"/cl[1-5]{1}.apple.com/"; metadata:created_at 2023_03_20, updated_at 2023_04_23; sid:3300814; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Mageni ☢ Vulnerability Scanner"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; ja3.hash; content:"f436b9416f37d134cadd04886327d3e8"; fast_pattern; tls_sni; content:"www.mageni.net"; endswith; nocase; reference:url,https://www.mageni.net/; metadata:created_at 2023_07_26, updated_at 2024_01_02; sid:3300815; rev:7; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Visual Studio Code Experiment Service"; flow:to_server, stateless; tls_sni; content:"default.exp-tas.com"; endswith; nocase; reference:url,https://code.visualstudio.com/docs/setup/network; metadata:created_at 2024_01_02, updated_at 2024_01_02; sid:3301108; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Garmin GPS software for 🪟 Windows"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; ja3.hash; content:"6591f269f98467808709ab91e378a3ab"; fast_pattern; tls_sni; content:"garmin.com"; endswith; nocase; reference:url,https://www.garmin.com/; metadata:created_at 2024_01_08, updated_at 2024_01_08; sid:3301114; rev:1; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Garmin GPS software for 🪟 Windows 11"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ssl_version:tls1.2; ja3.hash; content:"6a5d235ee78c6aede6a61448b4e9ff1e"; fast_pattern; tls_sni; content:"garmin.com"; endswith; nocase; reference:url,https://www.garmin.com/; metadata:created_at 2024_01_08, updated_at 2024_01_08; sid:3301115; rev:1; classtype:misc-activity;)
### Santé ###
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ MediReport 🏥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"medireportupdates.com"; http.user_agent; content:"MEDI"; nocase; reference:url,https://www.medireport.net/; metadata:created_at 2021_07_22, updated_at 2022_06_15; sid:3300816; rev:9; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ MediReport 🏥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"medireportupdates.com"; nocase; http.user_agent; content:"Mozilla/4.0"; nocase; reference:url,https://www.medireport.net/; metadata:created_at 2021_07_28, updated_at 2022_06_15; sid:3300817; rev:6; classtype:misc-activity;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ ACETIAM Télémédecine 🏥"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.host.raw; content:"update.etiam.com"; nocase; reference:url,https://www.acetiam.eu/fr/; metadata:created_at 2021_07_26, updated_at 2022_06_15; sid:3300818; rev:6; classtype:misc-activity;)
alert tls $HOME_NET any -> [185.116.179.21,145.239.164.218] any (msg:"🐾 - ℹ NEHS DIGITAL (Ex NGI) Medical Software 🏥"; flow: established, to_server; threshold: type limit, track by_dst,count 1, seconds 86400; reference:url,https://www.tp-link.com/; metadata:created_at 2021_08_26, updated_at 2022_06_15; sid:3300819; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ BCB Dexther 💊 Drugs Database 🇫🇷"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"maj.bcbdexther.fr"; nocase; ja3.hash; content:"51a7ad14509fd614c7bb3a50c4982b8c"; reference:url,https://www.bcb.fr/; metadata:created_at 2021_08_27, updated_at 2022_06_15; sid:3300820; rev:2; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ GE Healthcare Medical Device 🏥 - for Europe 🇪🇺"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; ja3.hash; content:"3b13f7660ae39f584b9b14e63b6aadf2"; reference:url,https://www.ge.com/europe/; metadata:created_at 2021_11_12, updated_at 2022_06_15; sid:3300821; rev:5; classtype:misc-activity;)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - ℹ Intellio Next - télétransmission 👨‍⚕️ 💰 🇫🇷"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; tls_sni; content:"app.intellionext.fr"; nocase; ja3.hash; content:"535aca3d99fc247509cd50933cd71d37"; reference:url,https://www.intellionext.fr/; metadata:created_at 2021_11_12, updated_at 2022_06_15; sid:3300822; rev:2; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"🐾 - ℹ Diagnostic tool for CPS (National 🇫🇷 healthcare ⚕️ authentication 🔑 smart card)"; flow:to_client, stateless; threshold: type limit, track by_dst,count 1, seconds 86400; tls.cert_subject; content:"CN=diagcps.eservices.esante.gouv.fr"; nocase; reference:url,https://esante.gouv.fr/produits-services/cartes-de-professionnels-de-sante; metadata:created_at 2022_05_02, updated_at 2022_06_15; sid:3300823; rev:2; classtype:misc-activity;)


### Dynamic DNS ###
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"longmusic.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300824; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"wikaba.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300825; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"zzux.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300826; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dumb1.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300827; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"onedumb.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300828; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"youdontcare.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300829; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"yourtrap.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300830; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"2waky.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300831; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"sexidude.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300832; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mefound.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300833; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"organiccrap.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300834; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"toythieves.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300835; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"justdied.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300836; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"jungleheart.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300837; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mrbasic.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300838; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mrbonus.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300839; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"x24hr.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300840; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns04.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300841; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns05.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300842; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"zyns.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300843; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"my03.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300844; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"fartit.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300845; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"itemdb.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300846; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"instanthq.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300847; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"xxuz.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300848; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"jkub.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300849; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"itsaol.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300850; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"faqserv.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300851; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"jetos.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300852; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"qpoe.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300853; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"qhigh.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300854; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"vizvaz.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300855; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mrface.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300856; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"isasecret.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300857; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mrslove.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300858; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"otzo.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300859; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"americanunfinished.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300860; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"serveusers.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300861; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"serveuser.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300862; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"freetcp.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300863; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ddns.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300864; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns01.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300865; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns02.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300866; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"myftp.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300867; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mydad.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300868; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mymom.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300869; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mypicture.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300870; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"myz.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300871; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"squirly.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300872; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"toh.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300873; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"xxxy.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300874; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"freewww.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300875; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"freeddns.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300876; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"myddns.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300877; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dynamicdns.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300878; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns01.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300879; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns02.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300880; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"xxxy.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300881; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"sexxxy.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300882; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"freewww.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300883; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"www1.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300884; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dhcp.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300885; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"edns.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300886; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ftp1.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300887; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mywww.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300888; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"gr8domain.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300889; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"gr8name.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300890; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ftpserver.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300891; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"wwwhost.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300892; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"moneyhome.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300893; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"port25.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300894; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"esmtp.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300895; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dsmtp.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300896; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"sixth.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300897; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ninth.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300898; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"misecure.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300899; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"got-game.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300900; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"bigmoney.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300901; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns2.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300902; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns1.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300903; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns02.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300904; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns01.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300905; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"changeip.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300906; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"changeip.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300907; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"almostmy.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300908; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ocry.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300909; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ourhobby.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300910; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dnsfailover.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300911; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ygto.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300912; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ddns.ms"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300913; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ddns.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300914; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"gettrials.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300915; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"25u.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300916; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"4dq.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300917; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"4pu.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300918; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"3-a.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300919; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dsmtp.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300920; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dsmtp.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300921; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mynumber.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300922; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns1.name"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300923; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns2.name"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300924; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ns3.name"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300925; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"rebatesrule.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300926; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ezua.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300927; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"sendsmtp.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300928; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ssmailer.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300929; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"trickip.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300930; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"trickip.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300931; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dnsrd.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300932; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"lflinkup.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300933; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"lflinkup.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300934; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"lflinkup.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300935; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"lflink.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300936; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns-dns.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300937; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"b0tnet.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300938; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"proxydns.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300939; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"changeip.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300940; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mysecondarydns.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300941; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"changeip.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300942; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns-stuff.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300943; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dynssl.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300944; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mylftv.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300945; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mynetav.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300946; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mynetav.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300947; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mynetav.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300948; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dns-report.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300949; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"homingbeacon.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300950; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ikwb.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300951; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"acmetoy.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300952; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ddns.mobi"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300953; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dnset.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300954; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"as19557.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300955; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"toshibanetcam.com"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300956; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"authorizeddns.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300957; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"authorizeddns.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300958; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"authorizeddns.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300959; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"cleansite.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300960; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"cleansite.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300961; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"cleansite.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300962; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"https443.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300963; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"https443.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300964; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mypop3.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300965; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"mypop3.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300966; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"ssl443.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300967; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"iownyour.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300968; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"iownyour.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300969; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"onmypc.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300970; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"onmypc.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300971; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"onmypc.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300972; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"onmypc.org"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300973; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"onmypc.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300974; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dubya.info"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300975; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dubya.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300976; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dubya.biz"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300977; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"dubya.net"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300978; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"wwwhost.us"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300979; rev:5; classtype:bad-unknown;)
alert dns any any -> any any (msg:"🐾 - 🤨 DNS Request to Change IP Free Dynamic DNS Hosting"; flow:to_server, stateless; threshold: type limit, track by_src, count 1, seconds 3600; dns_query; content:"changeip.co"; nocase; reference: url,https://www.changeip.com/accounts/cart.php?a=confproduct&i=0; metadata:created_at 2022_06_18, updated_at 2022_07_24; sid:3300980; rev:5; classtype:bad-unknown;)
### Online Scanner ###
alert ip [51.15.191.81,212.83.146.233,62.4.14.198,195.154.61.206,62.4.14.206,188.165.243.144,91.134.185.80/28,188.165.237.44,51.254.49.96/28,176.31.117.16,164.132.183.192/28,94.23.61.227,213.32.39.32/28,94.23.208.106,37.187.215.240/28,172.105.213.140,45.33.7.49,163.172.64.111,62.210.5.253,62.210.10.77,195.154.62.232,195.154.63.222,51.15.181.173,37.187.153.85,178.32.197.80/28,94.23.1.70,146.59.184.0/28,192.99.36.52,51.161.50.176/28,192.99.37.146,192.99.175.176/28,37.59.54.188,147.135.236.160/28,37.59.55.63,151.80.91.208/28,198.27.83.98,167.114.24.176/28,188.165.248.212,51.255.109.160/28,94.23.0.37,5.135.173.112/28,192.99.37.223,144.217.24.0/28,192.99.160.156,144.217.24.16/28,92.167.187.207] any -> any any (msg:"🐾 - ℹ ONYPHE 🇫🇷 - Cyber Defense Search Engine - Scanner 🕵"; flow: to_server, stateless; reference:url,http://sirii.probe.onyphe.net/; metadata:created_at 2021_08_25, updated_at 2022_06_15; sid:3300981; rev:3; classtype:misc-activity;)
alert ip [162.142.125.0/24,167.94.138.0/24,167.94.145.0/24,167.94.146.0/24,167.248.133.0/24,199.45.154.0/24,199.45.155.0/24,206.168.34.0/24,2602:80d:1003::/112,2602:80d:1004::/112,2602:80d:1000:b0cc:e::/80,2620:96:e000:b0cc:e::/80] any -> any any (msg:"🐾 - ℹ Censys - Scanner 🕵"; flow: to_server, stateless; reference:url,https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-of-Scanning; metadata:created_at 2022_08_03, updated_at 2024_06_12; sid:3300982; rev:2; classtype:misc-activity;)
alert ip [89.248.165.0/24] any -> any any (msg:"🐾 - ℹ Recyber Project - Scanner 🕵"; flow: to_server, stateless; reference:url,https://recyber.net/; metadata:created_at 2022_08_03, updated_at 2022_08_03; sid:3300983; rev:1; classtype:misc-activity;)
alert ip [198.235.24.0/24,205.210.31.0/24] any -> any any (msg:"🐾 - ℹ Palo Alto - Scanner 🕵 - 📧 scaninfo[AT]paloaltonetworks.com"; flow: to_server, stateless; reference:url,https://expanse.co/; reference:url,https://www.paloaltonetworks.com/cortex/cortex-xpanse; metadata:created_at 2022_08_03, updated_at 2022_08_03; sid:3300984; rev:1; classtype:misc-activity;)
alert ip [224.121.171.48,224.152.18.22,224.171.185.170,224.211.11.126,224.76.54.108,224.174.53.160,224.125.182.210,224.159.139.85,224.144.59.135,224.201.66.48,224.109.181.134,224.5.97.128,224.79.3.135,224.11.218.138,224.175.220.158,224.68.99.31,224.254.113.91,224.252.217.171,224.228.195.18,224.62.182.10,224.211.18.91,224.145.45.255,224.98.161.143,224.152.220.66,224.113.56.64,224.150.113.234,224.162.191.254,224.61.52.210,224.198.40.247] any -> any any (msg:"🐾 - ℹ Shodan - Scanner 🕵"; flow: to_server, stateless; reference:url,https://www.shodan.io; metadata:created_at 2023_02_05, updated_at 2023_02_05; sid:3300985; rev:1; classtype:misc-activity;)
alert ip [92.154.95.236,185.50.66.1,54.38.103.0,54.38.103.1,137.74.246.152,147.135.160.230,80.13.153.140] any -> any any (msg:"🐾 - ℹ 🛡 CERT-FR 🇫🇷 ANSSI - SILENE - Scanner 🕵"; flow: to_server, stateless; reference:url,https://www.cert.ssi.gouv.fr/scans/; metadata:created_at 2024_02_21, updated_at 2024_02_21; sid:3301141; rev:1; classtype:misc-activity;)
###-###
alert http $EXTERNAL_NET any -> any any (msg:"🐾 - ℹ Palo Alto - HTTP User-Agent Scanner 🕵 - 📧 scaninfo[AT]paloaltonetworks.com"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Expanse"; content:"Palo Alto Networks"; content:"scaninfo|40|paloaltonetworks.com"; fast_pattern; reference:url,https://expanse.co/; reference:url,https://www.paloaltonetworks.com/cortex/cortex-xpanse; metadata:created_at 2022_08_03, updated_at 2023_02_05; sid:3300986; rev:2; classtype:misc-activity;)
alert http $EXTERNAL_NET any -> any any (msg:"🐾 - ℹ Censys - HTTP User-Agent Scanner 🕵"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Mozilla/5.0"; startswith; content:"CensysInspect/"; content:"about.censys.io"; reference:url,https://support.censys.io/hc/en-us/articles/360043177092-Opt-Out-of-Scanning; metadata:created_at 2022_08_03, updated_at 2022_08_03; sid:3300987; rev:1; classtype:misc-activity;)
alert http $EXTERNAL_NET any -> any any (msg:"🐾 - ℹ Netcraft - HTTP User-Agent Scanner 🕵"; flow:to_server, stateless; threshold: type limit, track by_src,count 1, seconds 86400; http.user_agent; content:"Mozilla/5.0"; startswith; content:"NetcraftSurveyAgent/"; content:"info|40|netcraft.com"; reference:url,https://www.netcraft.com/; metadata:created_at 2022_08_03, updated_at 2022_08_03; sid:3300988; rev:1; classtype:misc-activity;)