sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
autarch/data/ioc/spyware/citizen_lab/202006_DarkBasin/snort.rules

1400 lines
561 KiB
Plaintext
Raw Permalink Blame History

#This part might still contain bugs, use and your own risk and report any issues.
#
# MISP export of IDS rules - optimized for snort
#
# These NIDS rules contain some variables that need to exist in your configuration.
# Make sure you have set:
#
# $HOME_NET - Your internal network range
# $EXTERNAL_NET - The network considered as outside
# $SMTP_SERVERS - All your internal SMTP servers
# $HTTP_PORTS - The ports used to contain HTTP traffic (not required with suricata export)
#
alert udp any any -> any 53 (msg: "Dark Basin Domain: 2mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|2mblk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: 2mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|2mblk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: 2mblk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"2mblk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])2mblk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: 4mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|4mblk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: 4mblk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|4mblk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: 4mblk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"4mblk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])4mblk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovangels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|ablyazovangels|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovangels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|ablyazovangels|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovangels.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovangels.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovangels\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcog.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|ablyazovcog|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcog.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|ablyazovcog|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcog.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcog.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcog\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimestory.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|ablyazovcrimestory|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimestory.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|ablyazovcrimestory|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcrimestory.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcrimestory.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcrimestory\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimesyndicate.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovcrimesyndicate|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcrimesyndicate.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovcrimesyndicate|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcrimesyndicate.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcrimesyndicate.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcrimesyndicate\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminalgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|ablyazovcriminalgang|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminalgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|ablyazovcriminalgang|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcriminalgang.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcriminalgang.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcriminalgang\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ablyazovcriminals|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovcriminals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ablyazovcriminals|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovcriminals.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovcriminals.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovcriminals\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ablyazovgang|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovgang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ablyazovgang|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovgang.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovgang.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovgang\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovmafia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|ablyazovmafia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovmafia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|ablyazovmafia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovmafia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovmafia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovmafia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ablyazovorganisedcrime.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovorganisedcrime|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ablyazovorganisedcrime.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|ablyazovorganisedcrime|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ablyazovorganisedcrime.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ablyazovorganisedcrime.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ablyazovorganisedcrime\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: affiliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|affiliatedomainservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: affiliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|affiliatedomainservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: affiliatedomainservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"affiliatedomainservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])affiliatedomainservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: affliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|affliatedomainservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: affliatedomainservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|affliatedomainservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: affliatedomainservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"affliatedomainservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])affliatedomainservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: allaboutiot.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|allaboutiot|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: allaboutiot.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|allaboutiot|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: allaboutiot.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"allaboutiot.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])allaboutiot\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: anitmationworldnews.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|anitmationworldnews|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: anitmationworldnews.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|anitmationworldnews|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: anitmationworldnews.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"anitmationworldnews.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])anitmationworldnews\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: anothershortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|anothershortnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: anothershortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|anothershortnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: anothershortnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"anothershortnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])anothershortnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: aplsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|aplsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: aplsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|aplsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: aplsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"aplsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])aplsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: assuredreturnplan.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|assuredreturnplan|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: assuredreturnplan.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|assuredreturnplan|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: assuredreturnplan.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"assuredreturnplan.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])assuredreturnplan\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: auditionregistrationonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|auditionregistrationonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: auditionregistrationonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|auditionregistrationonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: auditionregistrationonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"auditionregistrationonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])auditionregistrationonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: backwaterreservoir.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|backwaterreservoir|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: backwaterreservoir.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|backwaterreservoir|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: backwaterreservoir.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"backwaterreservoir.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])backwaterreservoir\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basemailservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basemailservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basemailservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basemailservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basemailservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: baseserveremailbg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|baseserveremailbg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: baseserveremailbg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|baseserveremailbg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: baseserveremailbg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"baseserveremailbg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])baseserveremailbg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basichostingrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|basichostingrussia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basichostingrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|basichostingrussia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basichostingrussia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basichostingrussia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basichostingrussia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basichostnetservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|basichostnetservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basichostnetservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|basichostnetservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basichostnetservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basichostnetservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basichostnetservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicmyoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicmyoffshore|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicmyoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicmyoffshore|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicmyoffshore.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicmyoffshore.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicmyoffshore\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicruoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicruoffshore|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicruoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicruoffshore|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicruoffshore.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicruoffshore.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicruoffshore\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicehk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicehk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicehk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicehk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicehk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicelux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicelux|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicelux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicelux|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicelux.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicelux.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicelux\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicemy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicemy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicemy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicemy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicemy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicerus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicerus|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicerus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicservicerus|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicerus.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicerus.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicerus\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicesg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|basicservicesg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicservicesg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicservicesg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicservicesg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: basicsgoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicsgoffshore|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: basicsgoffshore.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|basicsgoffshore|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: basicsgoffshore.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"basicsgoffshore.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])basicsgoffshore\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: bellsouthnetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bellsouthnetwork|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: bellsouthnetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bellsouthnetwork|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bellsouthnetwork.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bellsouthnetwork.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bellsouthnetwork\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: belowmargins.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|belowmargins|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: belowmargins.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|belowmargins|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: belowmargins.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"belowmargins.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])belowmargins\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: bitserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|bitserverhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: bitserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|bitserverhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bitserverhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bitserverhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bitserverhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: bitserverlux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|bitserverlux|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: bitserverlux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|bitserverlux|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bitserverlux.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bitserverlux.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bitserverlux\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: blogforpranks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|blogforpranks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: blogforpranks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|blogforpranks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: blogforpranks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"blogforpranks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])blogforpranks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: blogserverlx.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|blogserverlx|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: blogserverlx.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|blogserverlx|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: blogserverlx.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"blogserverlx.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])blogserverlx\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: browserdirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|browserdirectservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: browserdirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|browserdirectservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: browserdirectservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"browserdirectservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])browserdirectservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: browserextensions.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|browserextensions|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: browserextensions.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|browserextensions|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: browserextensions.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"browserextensions.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])browserextensions\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: browserredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|browserredirect|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: browserredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|browserredirect|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: browserredirect.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"browserredirect.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])browserredirect\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: bsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|bsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: bsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|bsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: bsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"bsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])bsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: budgtoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: budgtoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: budgtoffmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"budgtoffmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])budgtoffmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: budgtoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: budgtoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|budgtoffru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: budgtoffru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"budgtoffru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])budgtoffru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffbul.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|buzzoffbul|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffbul.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|buzzoffbul|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffbul.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffbul.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffbul\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: buzzoffsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: buzzoffsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|buzzoffsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: buzzoffsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"buzzoffsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])buzzoffsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: capitalinvestmentsllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|capitalinvestmentsllp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: capitalinvestmentsllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|capitalinvestmentsllp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: capitalinvestmentsllp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"capitalinvestmentsllp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])capitalinvestmentsllp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: cathostingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|cathostingservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: cathostingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|cathostingservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: cathostingservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"cathostingservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])cathostingservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: chatserverrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chatserverrussia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: chatserverrussia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chatserverrussia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: chatserverrussia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"chatserverrussia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])chatserverrussia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: checkmailserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|checkmailserverhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: checkmailserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|checkmailserverhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: checkmailserverhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"checkmailserverhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])checkmailserverhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: chromeperfection.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chromeperfection|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: chromeperfection.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|chromeperfection|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: chromeperfection.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"chromeperfection.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])chromeperfection\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-ar-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-ar-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-ar-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-ar-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-ar-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-ar-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-ar\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-authmail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-authmail|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-authmail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-authmail|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-authmail.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-authmail.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-authmail\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-biz.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-biz|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-biz.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-biz|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-biz.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-biz.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-biz\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-com-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|com-com-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-com-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|com-com-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-com-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-com-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-com\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-com.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-com|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-com.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|com-com|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-com.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-com.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-com\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-en-us.co.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|com-en-us|02|co|02|uk|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-en-us.co.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|com-en-us|02|co|02|uk|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-en-us.co.uk"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-en-us.co.uk"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-en\-us\.co\.uk[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-er-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-er-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-er-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-er-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-er-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-er-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-er\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-hl-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-hl-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-hl-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-hl-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-hl-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-hl-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-hl\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-io-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-io-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-io-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-io-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-io-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-io-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-io\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-mail-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|com-mail-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-mail-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|com-mail-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-mail-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-mail-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-mail\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-mail.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|com-mail|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-mail.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|com-mail|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-mail.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-mail.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-mail\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-nh-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-nh-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-nh-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-nh-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-nh-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-nh-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-nh\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-oa-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-oa-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-oa-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-oa-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-oa-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-oa-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-oa\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-us-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-us-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-us-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|com-us-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-us-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-us-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-us\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|biz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|biz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.biz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.biz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.biz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: com-website33.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: com-website33.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|com-website33|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: com-website33.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"com-website33.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])com\-website33\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: comservicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|comservicelogin|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: comservicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|comservicelogin|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: comservicelogin.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"comservicelogin.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])comservicelogin\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-en-gb.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-gb|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-en-gb.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-gb|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-en-gb.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-en-gb.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-en\-gb\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-us|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-en-us.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-en-us|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-en-us.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-en-us.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-en\-us\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-fr-fr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-fr-fr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-fr-fr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|corn-fr-fr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-fr-fr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-fr-fr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-fr\-fr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-lang-eng.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|corn-lang-eng|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-lang-eng.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|corn-lang-eng|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-lang-eng.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-lang-eng.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-lang\-eng\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-loginservicesverified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|corn-loginservicesverified|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-loginservicesverified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|corn-loginservicesverified|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-loginservicesverified.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-loginservicesverified.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-loginservicesverified\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-msrvrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|corn-msrvrgr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-msrvrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|corn-msrvrgr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-msrvrgr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-msrvrgr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-msrvrgr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|corn-servicelogin|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|corn-servicelogin|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-servicelogin.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-servicelogin.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-servicelogin\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: corn-ukr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|corn-ukr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: corn-ukr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|corn-ukr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: corn-ukr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"corn-ukr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])corn\-ukr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: csrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|csrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: csrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|csrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: csrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"csrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])csrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: cyberanalyticals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|cyberanalyticals|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: cyberanalyticals.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|cyberanalyticals|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: cyberanalyticals.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"cyberanalyticals.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])cyberanalyticals\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: cyberserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|cyberserverusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: cyberserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|cyberserverusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: cyberserverusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"cyberserverusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])cyberserverusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: deferrer.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|deferrer|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: deferrer.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|deferrer|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: deferrer.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"deferrer.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])deferrer\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: demoprojectsuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|demoprojectsuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: demoprojectsuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|demoprojectsuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: demoprojectsuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"demoprojectsuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])demoprojectsuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: dnsserverprv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|dnsserverprv|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: dnsserverprv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|dnsserverprv|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dnsserverprv.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dnsserverprv.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dnsserverprv\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainblacklistcheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainblacklistcheck|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainblacklistcheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainblacklistcheck|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainblacklistcheck.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainblacklistcheck.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainblacklistcheck\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainemailhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainemailhostings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainemailhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainemailhostings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainemailhostings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainemailhostings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainemailhostings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainexpertswebuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainexpertswebuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainexpertswebuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainexpertswebuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainexpertswebuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainexpertswebuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainexpertswebuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainforhostuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainforhostuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainforhostuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainforhostuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainforhostuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainforhostuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainforhostuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainformailinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainformailinguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainformailinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainformailinguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainformailinguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainformailinguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainformailinguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainhostnetworkuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|domainhostnetworkuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainhostnetworkuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainhostnetworkuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainhostnetworkuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainhostnetworkusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainhostnetworkusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainhostnetworkusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainhostnetworkusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainhostnetworkusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainhostnetworkusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainhostworkeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|domainhostworkeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainhostworkeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|domainhostworkeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainhostworkeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainhostworkeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainhostworkeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostingeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostingeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainlocalhostingeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainlocalhostingeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainlocalhostingeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinghk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinghk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainlocalhostinghk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainlocalhostinghk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainlocalhostinghk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainlocalhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|domainlocalhostinguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainlocalhostinguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainlocalhostinguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainlocalhostinguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainmanager33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainmanager33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainmanager33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|04|site|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|04|site|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainmanager33.site"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainmanager33.site"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainmanager33\.site[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainmanager33.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainmanager33|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainmanager33.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainmanager33.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainmanager33\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainserver322.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver322|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainserver322.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver322|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainserver322.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainserver322.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainserver322\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainserver399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainserver399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainserver399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainserver399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainserveractive.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainserveractive|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainserveractive.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainserveractive|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainserveractive.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainserveractive.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainserveractive\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsforfreehosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|domainsforfreehosting|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsforfreehosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|domainsforfreehosting|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsforfreehosting.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsforfreehosting.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsforfreehosting\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsforsupport.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|domainsforsupport|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsforsupport.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|domainsforsupport|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsforsupport.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsforsupport.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsforsupport\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainsfortechhelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|domainsfortechhelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsfortechhelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsfortechhelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsfortechhelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: domainsserver4f.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainsserver4f|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: domainsserver4f.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|domainsserver4f|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: domainsserver4f.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"domainsserver4f.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])domainsserver4f\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: dotnerserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnerserversg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: dotnerserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnerserversg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dotnerserversg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dotnerserversg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dotnerserversg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: dotnetserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnetserverhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: dotnetserverhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dotnetserverhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dotnetserverhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dotnetserverhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dotnetserverhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: dsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: dsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: dsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"dsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])dsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ecom-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ecom-servicelogin|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ecom-servicelogin.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|ecom-servicelogin|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ecom-servicelogin.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ecom-servicelogin.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ecom\-servicelogin\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: economyfeeds.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|economyfeeds|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: economyfeeds.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|economyfeeds|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: economyfeeds.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"economyfeeds.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])economyfeeds\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: economyservicesil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|economyservicesil|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: economyservicesil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|economyservicesil|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: economyservicesil.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"economyservicesil.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])economyservicesil\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ecoserveraus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ecoserveraus|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ecoserveraus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ecoserveraus|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ecoserveraus.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ecoserveraus.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ecoserveraus\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailauthservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailauthservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailauthservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailauthservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailauthservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailbaseserverhl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailbaseserverhl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailbaseserverhl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailbaseserverhl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailbaseserverhl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailbaseserverhl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailbaseserverhl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emaildeliverysuccess.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emaildeliverysuccess|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emaildeliverysuccess.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emaildeliverysuccess|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emaildeliverysuccess.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emaildeliverysuccess.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emaildeliverysuccess\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailhostholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailhostholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailhostholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|emailhostholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailhostholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailhostholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailhostholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailhostsecurehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailhostsecurehk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailhostsecurehk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|emailhostsecurehk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailhostsecurehk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailhostsecurehk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailhostsecurehk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailmappingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|emailmappingservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailmappingservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|emailmappingservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailmappingservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailmappingservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailmappingservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailsecurenode.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailsecurenode|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailsecurenode.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailsecurenode|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailsecurenode.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailsecurenode.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailsecurenode\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserver399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserver399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserver399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserver4859.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserver4859|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserver4859.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserver4859|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserver4859.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserver4859.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserver4859\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserver499.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver499|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserver499.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|emailserver499|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserver499.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserver499.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserver499\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserverhk48.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserverhk48|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserverhk48.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailserverhk48|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserverhk48.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserverhk48.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserverhk48\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailserverholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailserverholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailserverholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailserverholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailserverholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailservername299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailservername299|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailservername299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|emailservername299|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailservername299.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailservername299.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailservername299\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailseverrus23.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailseverrus23|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailseverrus23.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|emailseverrus23|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailseverrus23.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailseverrus23.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailseverrus23\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: emailvalidateservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emailvalidateservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: emailvalidateservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|emailvalidateservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: emailvalidateservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"emailvalidateservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])emailvalidateservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: esrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|esrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: esrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|esrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: esrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"esrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])esrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: euanticorruption.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|euanticorruption|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: euanticorruption.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|euanticorruption|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: euanticorruption.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"euanticorruption.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])euanticorruption\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: exchangeserver2345.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|exchangeserver2345|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: exchangeserver2345.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|exchangeserver2345|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: exchangeserver2345.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"exchangeserver2345.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])exchangeserver2345\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: exchangeserverformailing.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|exchangeserverformailing|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: exchangeserverformailing.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|exchangeserverformailing|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: exchangeserverformailing.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"exchangeserverformailing.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])exchangeserverformailing\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: extranetserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|extranetserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: extranetserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|extranetserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: extranetserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"extranetserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])extranetserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: fastserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|fastserverasia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|fastserverasia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastserverasia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastserverasia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastserverasia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: fastservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|fastservereurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|fastservereurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastservereurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastservereurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastservereurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: fastserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|fastserveruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|fastserveruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastserveruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastserveruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastserveruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: fastserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|fastserverusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: fastserverusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|fastserverusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: fastserverusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"fastserverusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])fastserverusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: forumtechtopic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|forumtechtopic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: forumtechtopic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|forumtechtopic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: forumtechtopic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"forumtechtopic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])forumtechtopic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: frwrdrurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|frwrdrurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: frwrdrurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|frwrdrurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: frwrdrurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"frwrdrurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])frwrdrurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: frwrdrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|frwrdrwr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: frwrdrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|frwrdrwr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: frwrdrwr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"frwrdrwr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])frwrdrwr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: getemailopens.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|getemailopens|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: getemailopens.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|getemailopens|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: getemailopens.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"getemailopens.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])getemailopens\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: getreadytorunhalfmarathon.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|19|getreadytorunhalfmarathon|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: getreadytorunhalfmarathon.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|19|getreadytorunhalfmarathon|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: getreadytorunhalfmarathon.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"getreadytorunhalfmarathon.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])getreadytorunhalfmarathon\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: getsetgoforhealth.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|getsetgoforhealth|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: getsetgoforhealth.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|getsetgoforhealth|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: getsetgoforhealth.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"getsetgoforhealth.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])getsetgoforhealth\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: goomail.ml"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|goomail|02|ml|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: goomail.ml"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|goomail|02|ml|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: goomail.ml"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"goomail.ml"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])goomail\.ml[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hardcoretechnologiesllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hardcoretechnologiesllp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hardcoretechnologiesllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hardcoretechnologiesllp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hardcoretechnologiesllp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hardcoretechnologiesllp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hardcoretechnologiesllp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hathwaynetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hathwaynetwork|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hathwaynetwork.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hathwaynetwork|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hathwaynetwork.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hathwaynetwork.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hathwaynetwork\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hbh-europe-ripoff-report.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|hbh-europe-ripoff-report|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hbh-europe-ripoff-report.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|hbh-europe-ripoff-report|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hbh-europe-ripoff-report.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hbh-europe-ripoff-report.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hbh\-europe\-ripoff\-report\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hiretechservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hiretechservicehg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hiretechservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hiretechservicehg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hiretechservicehg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hiretechservicehg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hiretechservicehg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hkdrillonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hkdrillonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hkdrillonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hkdrillonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hkdrillonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hkdrillonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hkdrillonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hklinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|hklinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hklinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|hklinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hklinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hklinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hklinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hollandtourandtravel.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hollandtourandtravel|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hollandtourandtravel.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hollandtourandtravel|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hollandtourandtravel.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hollandtourandtravel.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hollandtourandtravel\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: homeforallorphans.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|homeforallorphans|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: homeforallorphans.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|homeforallorphans|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: homeforallorphans.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"homeforallorphans.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])homeforallorphans\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: homeremedytipntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|homeremedytipntricks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: homeremedytipntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|homeremedytipntricks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: homeremedytipntricks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"homeremedytipntricks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])homeremedytipntricks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: homeserver87.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|homeserver87|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: homeserver87.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|homeserver87|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: homeserver87.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"homeserver87.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])homeserver87\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hongkongshippingcompany.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hongkongshippingcompany|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hongkongshippingcompany.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|hongkongshippingcompany|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hongkongshippingcompany.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hongkongshippingcompany.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hongkongshippingcompany\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasichk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasichk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasichk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasichk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasichk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicholl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostbasicholl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicholl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostbasicholl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicholl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicholl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicholl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|hostbasicsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostbasicsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostbasicsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostbasicsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostemailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|hostemailsecureserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostemailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|hostemailsecureserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostemailsecureserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostemailsecureserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostemailsecureserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostemailserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostemailserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostemailserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostemailserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostemailserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostemailserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostemailserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostfeasta.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hostfeasta|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostfeasta.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hostfeasta|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostfeasta.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostfeasta.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostfeasta\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceclean.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingserviceclean|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceclean.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingserviceclean|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingserviceclean.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingserviceclean.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingserviceclean\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceforall.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingserviceforall|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingserviceforall.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingserviceforall|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingserviceforall.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingserviceforall.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingserviceforall\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesloyal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingservicesloyal|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesloyal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostingservicesloyal|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingservicesloyal.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingservicesloyal.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingservicesloyal\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesukit.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingservicesukit|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostingservicesukit.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|hostingservicesukit|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostingservicesukit.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostingservicesukit.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostingservicesukit\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostmailsecure|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostmailsecure|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostmailsecure.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostmailsecure.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostmailsecure\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostmailsecureserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostmailsecureserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|hostmailsecureserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostmailsecureserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostmailsecureserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostmailsecureserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostsecuremail|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|hostsecuremail|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostsecuremail.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostsecuremail.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostsecuremail\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail544.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hostsecuremail544|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostsecuremail544.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hostsecuremail544|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostsecuremail544.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostsecuremail544.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostsecuremail544\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostserverrus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostserverrus|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostserverrus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|hostserverrus|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostserverrus.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostserverrus.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostserverrus\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: hostusewithtech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostusewithtech|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: hostusewithtech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|hostusewithtech|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: hostusewithtech.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"hostusewithtech.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])hostusewithtech\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: imapserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|imapserverholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: imapserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|imapserverholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: imapserverholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"imapserverholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])imapserverholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: imgsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|imgsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: imgsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|imgsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: imgsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"imgsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])imgsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: inrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|inrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: inrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|inrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: inrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"inrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])inrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: internetmarketingservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|internetmarketingservicehg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: internetmarketingservicehg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|internetmarketingservicehg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: internetmarketingservicehg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"internetmarketingservicehg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])internetmarketingservicehg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: interserver439.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|interserver439|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: interserver439.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|interserver439|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: interserver439.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"interserver439.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])interserver439\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: intrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|intrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: intrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|intrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: intrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"intrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])intrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: isrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|isrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: isrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|isrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: isrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"isrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])isrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: javaservermy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|javaservermy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: javaservermy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|javaservermy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: javaservermy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"javaservermy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])javaservermy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: knowledgebaseonlineuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|knowledgebaseonlineuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356931; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: knowledgebaseonlineuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|knowledgebaseonlineuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356932; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: knowledgebaseonlineuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"knowledgebaseonlineuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])knowledgebaseonlineuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356933; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linkfollowservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|linkfollowservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkfollowservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|linkfollowservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkfollowservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkfollowservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkfollowservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linkforwrder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkforwrder|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkforwrder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkforwrder|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkforwrder.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkforwrder.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkforwrder\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linkshortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|linkshortnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkshortnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|linkshortnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkshortnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkshortnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkshortnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linkshrtnr22.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkshrtnr22|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353311; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linkshrtnr22.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linkshrtnr22|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353312; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linkshrtnr22.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linkshrtnr22.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linkshrtnr22\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353313; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linksrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|linksrtnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linksrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|linksrtnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linksrtnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linksrtnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linksrtnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasichk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasichk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasichk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasichk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasichk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasichk1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasichk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasichk1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasichk1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasichk1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasichk1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicru1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicru1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicru1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru3.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru3|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicru3.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicru3|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicru3.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicru3.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicru3\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|linuxbasicsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicsg1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxbasicsg1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|linuxbasicsg1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxbasicsg1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxbasicsg1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxbasicsg1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxhostingplatformuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|linuxhostingplatformuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxhostingplatformuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|linuxhostingplatformuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxhostingplatformuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxhostingplatformuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxhostingplatformuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: linuxserverfast.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|linuxserverfast|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: linuxserverfast.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|linuxserverfast|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: linuxserverfast.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"linuxserverfast.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])linuxserverfast\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: lnkshrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|lnkshrtnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: lnkshrtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|lnkshrtnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: lnkshrtnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"lnkshrtnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])lnkshrtnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: localhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|localhostinguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: localhostinguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|localhostinguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: localhostinguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"localhostinguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])localhostinguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: localserversa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|localserversa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: localserversa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|localserversa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: localserversa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"localserversa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])localserversa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: loginauths-service.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|loginauths-service|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginauths-service.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|loginauths-service|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginauths-service.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginauths-service.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginauths\-service\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: logincontrolserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|logincontrolserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354971; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: logincontrolserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|logincontrolserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354972; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: logincontrolserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"logincontrolserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])logincontrolserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354973; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservercheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservercheck|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservercheck.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservercheck|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservercheck.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservercheck.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservercheck\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservicebasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|loginservicebasic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservicebasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|loginservicebasic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservicebasic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservicebasic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservicebasic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservicehelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservicehelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservicehelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|loginservicehelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservicehelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservicehelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservicehelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: loginservicesmailsonlinesaccounts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|21|loginservicesmailsonlinesaccounts|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginservicesmailsonlinesaccounts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|21|loginservicesmailsonlinesaccounts|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginservicesmailsonlinesaccounts.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginservicesmailsonlinesaccounts.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginservicesmailsonlinesaccounts\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: loginserviceunified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|loginserviceunified|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: loginserviceunified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|loginserviceunified|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: loginserviceunified.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"loginserviceunified.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])loginserviceunified\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: logserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|logserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: logserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|logserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: logserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"logserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])logserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: look-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|look-com|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: look-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|look-com|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: look-com.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"look-com.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])look\-com\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: luxlinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|luxlinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: luxlinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|luxlinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: luxlinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"luxlinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])luxlinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mail-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mail-com|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mail-com.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mail-com|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mail-com.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mail-com.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mail\-com\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mail-logger.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mail-logger|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353611; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mail-logger.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mail-logger|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353612; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mail-logger.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mail-logger.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mail\-logger\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353613; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mail-msrgr.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|mail-msrgr|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mail-msrgr.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|mail-msrgr|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mail-msrgr.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mail-msrgr.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mail\-msrgr\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailannounceservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|mailannounceservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailannounceservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|mailannounceservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailannounceservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailannounceservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailannounceservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailapiservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailapiservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailapiservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailapiservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailapiservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthenticatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthenticatorservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthenticatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthenticatorservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthenticatorservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthenticatorservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthenticatorservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthorizationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthorizationservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355101; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthorizationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailauthorizationservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355102; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthorizationservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthorizationservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthorizationservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355103; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailauthservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailauthservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailauthservice399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailauthservice399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailauthservice399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailauthservice399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailauthservice399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailauthservice399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailchimpservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailchimpservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailchimpservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailchimpservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailchimpservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailchimpservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailchimpservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailcollectorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailcollectorservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailcollectorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailcollectorservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailcollectorservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailcollectorservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailcollectorservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailcommunicationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailcommunicationservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailcommunicationservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|mailcommunicationservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailcommunicationservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailcommunicationservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailcommunicationservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailcommute.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mailcommute|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailcommute.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mailcommute|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailcommute.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailcommute.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailcommute\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: maildeliveryagent.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|maildeliveryagent|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: maildeliveryagent.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|maildeliveryagent|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: maildeliveryagent.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"maildeliveryagent.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])maildeliveryagent\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailer-domain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailer-domain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailer-domain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailer-domain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailer-domain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailer-domain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailer\-domain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailerdomain56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailerdomain56|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailerdomain56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailerdomain56|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailerdomain56.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailerdomain56.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailerdomain56\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailgatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailgatorservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailgatorservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailgatorservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailgatorservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailgatorservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailgatorservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailhostingsecurenet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailhostingsecurenet|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailhostingsecurenet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailhostingsecurenet|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailhostingsecurenet.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailhostingsecurenet.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailhostingsecurenet\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailingserver938.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailingserver938|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354431; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailingserver938.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailingserver938|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354432; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailingserver938.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailingserver938.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailingserver938\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354433; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: maillinkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maillinkservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: maillinkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maillinkservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: maillinkservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"maillinkservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])maillinkservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailmarknotes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailmarknotes|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailmarknotes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mailmarknotes|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailmarknotes.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailmarknotes.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailmarknotes\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailmarkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailmarkservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailmarkservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailmarkservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailmarkservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailmarkservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailmarkservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailpostsecure|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecure.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailpostsecure|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailpostsecure.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailpostsecure.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailpostsecure\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecureservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|mailpostsecureservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailpostsecureservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|mailpostsecureservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailpostsecureservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailpostsecureservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailpostsecureservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailrockservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailrockservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailrockservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailrockservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailrockservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailrockservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailrockservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailsecurehost.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailsecurehost|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailsecurehost.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailsecurehost|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailsecurehost.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailsecurehost.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailsecurehost\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailsecureservers.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailsecureservers|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailsecureservers.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailsecureservers|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailsecureservers.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailsecureservers.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailsecureservers\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver89.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver89.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver89\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver89.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver89.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver89\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserver89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserver89|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserver89.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserver89.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserver89\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserverdirect3994.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverdirect3994|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserverdirect3994.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverdirect3994|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserverdirect3994.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserverdirect3994.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserverdirect3994\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserverenterprise.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverenterprise|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserverenterprise.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|mailserverenterprise|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserverenterprise.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserverenterprise.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserverenterprise\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailservereurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailservereurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailservereurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailservereurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailservereurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveroutlook.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailserveroutlook|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveroutlook.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|mailserveroutlook|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveroutlook.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveroutlook.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveroutlook\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserverru2099.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailserverru2099|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserverru2099.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mailserverru2099|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserverru2099.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserverru2099.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserverru2099\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailservershare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailservershare|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailservershare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|mailservershare|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailservershare.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailservershare.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailservershare\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserveruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|mailserveruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk89.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk89.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk89\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk89.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk89.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk89\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserveruk89.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mailserveruk89|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserveruk89.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserveruk89.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserveruk89\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailserviceloginonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|mailserviceloginonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355091; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailserviceloginonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|mailserviceloginonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355092; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailserviceloginonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailserviceloginonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailserviceloginonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355093; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailtickr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mailtickr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354111; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailtickr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mailtickr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354112; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailtickr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailtickr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailtickr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354113; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mailtransferserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailtransferserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mailtransferserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|mailtransferserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mailtransferserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mailtransferserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mailtransferserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: maxlaboratories.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maxlaboratories|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: maxlaboratories.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|maxlaboratories|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: maxlaboratories.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"maxlaboratories.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])maxlaboratories\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mblk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mblk1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mblk1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mblk1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mblk1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mblk1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mblk1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mgrsr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mgrsr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mgrsr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mgrsr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mgrsr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mgrsr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mgrsr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: minrsrvr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|minrsrvr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: minrsrvr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|minrsrvr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: minrsrvr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"minrsrvr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])minrsrvr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mnrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mnrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357381; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mnrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mnrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357382; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mnrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mnrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mnrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357383; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mrgrhr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mrgrhr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mrgrhr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mrgrhr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mrgrhr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mrgrhr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mrgrhr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: msgrdrg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msgrdrg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: msgrdrg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msgrdrg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msgrdrg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msgrdrg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msgrdrg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: msrdr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrdr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrdr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrdr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrdr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrdr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrdr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: msrfrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrfrgr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrfrgr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrfrgr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrfrgr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrfrgr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrfrgr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: msrvrgeh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|msrvrgeh|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrvrgeh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|msrvrgeh|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrvrgeh.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrvrgeh.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrvrgeh\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: msrvrgh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrvrgh|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrvrgh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|msrvrgh|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrvrgh.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrvrgh.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrvrgh\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: msrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrwr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: msrwr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|msrwr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: msrwr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"msrwr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])msrwr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mvrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mvrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mvrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mvrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mvrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mvrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mvrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: myfacetik.cf"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|myfacetik|02|cf|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: myfacetik.cf"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|myfacetik|02|cf|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: myfacetik.cf"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"myfacetik.cf"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])myfacetik\.cf[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mylinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mylinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mylinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mylinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mylinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mylinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mylinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: mywebredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mywebredirect|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: mywebredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|mywebredirect|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: mywebredirect.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"mywebredirect.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])mywebredirect\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: nameserver3476.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|nameserver3476|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: nameserver3476.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|nameserver3476|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nameserver3476.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nameserver3476.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nameserver3476\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: nameserverredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|nameserverredirect|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: nameserverredirect.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|nameserverredirect|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nameserverredirect.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nameserverredirect.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nameserverredirect\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netcomserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|netcomserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netcomserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|netcomserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netcomserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netcomserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netcomserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netgeoserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|netgeoserversg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netgeoserversg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|netgeoserversg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netgeoserversg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netgeoserversg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netgeoserversg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netmapservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|netmapservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netmapservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|netmapservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netmapservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netmapservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netmapservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecureemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|netsecureemailservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecureemailservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|netsecureemailservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecureemailservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecureemailservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecureemailservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecurehostingmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecurehostingmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecurehostingmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecurehostingmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecurehostingmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecurehostingmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecurehostingmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecuremailhosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|netsecuremailhosting|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecuremailhosting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|netsecuremailhosting|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecuremailhosting.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecuremailhosting.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecuremailhosting\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netsecureserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecureserver399|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netsecureserver399.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|netsecureserver399|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netsecureserver399.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netsecureserver399.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netsecureserver399\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: netserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|netserviceru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: netserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|netserviceru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: netserviceru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"netserviceru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])netserviceru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: networkshareserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|networkshareserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354391; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: networkshareserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|networkshareserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354392; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: networkshareserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"networkshareserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])networkshareserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354393; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: newserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|newserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: newserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|newserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: newserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"newserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])newserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: nigeriaoilleaks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|nigeriaoilleaks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: nigeriaoilleaks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|nigeriaoilleaks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nigeriaoilleaks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nigeriaoilleaks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nigeriaoilleaks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: nodeserver50.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|nodeserver50|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: nodeserver50.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|nodeserver50|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nodeserver50.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nodeserver50.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nodeserver50\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: nrgrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|nrgrsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: nrgrsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|nrgrsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: nrgrsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"nrgrsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])nrgrsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: offshorecompanyllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|offshorecompanyllp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: offshorecompanyllp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|offshorecompanyllp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: offshorecompanyllp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"offshorecompanyllp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])offshorecompanyllp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: offshoretoursntravels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|offshoretoursntravels|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: offshoretoursntravels.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|offshoretoursntravels|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: offshoretoursntravels.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"offshoretoursntravels.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])offshoretoursntravels\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ondemand.pushthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|ondemand|0b|pushthisurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ondemand.pushthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|ondemand|0b|pushthisurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ondemand.pushthisurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ondemand.pushthisurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ondemand\.pushthisurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|onlineloginportal|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355811; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|onlineloginportal|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355812; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportal.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportal.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportal\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355813; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355821; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355822; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportalhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportalhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportalhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355823; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355831; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355832; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportalmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportalmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportalmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355833; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355841; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginportalsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|onlineloginportalsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355842; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginportalsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginportalsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginportalsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355843; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginserviceeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginserviceeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginserviceeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlineloginserviceuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginserviceuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginserviceuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginserviceuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|onlineloginserviceusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlineloginserviceusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|onlineloginserviceusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlineloginserviceusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlineloginserviceusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlineloginserviceusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlinemusicstoreuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|onlinemusicstoreuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlinemusicstoreuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|onlinemusicstoreuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlinemusicstoreuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlinemusicstoreuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlinemusicstoreuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: onlinenetworkinghelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlinenetworkinghelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: onlinenetworkinghelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|onlinenetworkinghelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: onlinenetworkinghelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"onlinenetworkinghelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])onlinenetworkinghelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: openserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|openserverholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: openserverholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|openserverholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: openserverholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"openserverholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])openserverholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalblogging.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|optionalblogging|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalblogging.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|optionalblogging|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalblogging.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalblogging.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalblogging\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginges.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginges|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginges.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginges|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalblogginges.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalblogginges.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalblogginges\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalbloggingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalbloggingeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356251; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalbloggingeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalbloggingeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356252; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalbloggingeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalbloggingeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalbloggingeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356253; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginguk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356261; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionalblogginguk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|optionalblogginguk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356262; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionalblogginguk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionalblogginguk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionalblogginguk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356263; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: optionaldesigners.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|optionaldesigners|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionaldesigners.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|optionaldesigners|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionaldesigners.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionaldesigners.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionaldesigners\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: optionsothego.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|optionsothego|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: optionsothego.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|optionsothego|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: optionsothego.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"optionsothego.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])optionsothego\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: pageredirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|pageredirectservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354951; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageredirectservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|pageredirectservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354952; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageredirectservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageredirectservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageredirectservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354953; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: pageserver299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|pageserver299|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353341; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageserver299.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|pageserver299|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353342; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageserver299.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageserver299.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageserver299\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353343; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: pageserver77.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserver77|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageserver77.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserver77|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageserver77.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageserver77.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageserver77\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: pageserverru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserverru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: pageserverru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|pageserverru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: pageserverru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"pageserverru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])pageserverru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355851; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355852; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: personaldoaminru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"personaldoaminru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])personaldoaminru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355853; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: personaldoaminsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|personaldoaminsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: personaldoaminsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"personaldoaminsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])personaldoaminsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.best"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|best|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354041; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.best"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|best|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354042; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.best"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.best"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.best[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354043; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|site|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.site"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|site|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.site"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.site"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.site[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.tech"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|tech|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.tech"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|04|tech|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.tech"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.tech"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.tech[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: phpwebserver34.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|phpwebserver34|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: phpwebserver34.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"phpwebserver34.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])phpwebserver34\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: planyourexoticvacation.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|planyourexoticvacation|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: planyourexoticvacation.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|planyourexoticvacation|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: planyourexoticvacation.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"planyourexoticvacation.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])planyourexoticvacation\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: portfoliofasinating.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|portfoliofasinating|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: portfoliofasinating.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|portfoliofasinating|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: portfoliofasinating.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"portfoliofasinating.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])portfoliofasinating\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: post-manager.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|post-manager|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: post-manager.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|post-manager|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: post-manager.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"post-manager.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])post\-manager\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: postmarkapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|postmarkapiservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: postmarkapiservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|postmarkapiservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: postmarkapiservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"postmarkapiservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])postmarkapiservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: postserverem.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|postserverem|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: postserverem.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|postserverem|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: postserverem.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"postserverem.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])postserverem\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: postserviceemaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|postserviceemaildomain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: postserviceemaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|postserviceemaildomain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: postserviceemaildomain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"postserviceemaildomain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])postserviceemaildomain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ppleid.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ppleid|03|org|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ppleid.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ppleid|03|org|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ppleid.org"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ppleid.org"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ppleid\.org[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: productdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|productdemoservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: productdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|productdemoservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: productdemoservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"productdemoservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])productdemoservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: promotespritialbelief.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|promotespritialbelief|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356941; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: promotespritialbelief.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|promotespritialbelief|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356942; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: promotespritialbelief.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"promotespritialbelief.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])promotespritialbelief\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356943; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: prwebsiteuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|prwebsiteuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: prwebsiteuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|prwebsiteuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: prwebsiteuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"prwebsiteuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])prwebsiteuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: racksackserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|racksackserveruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: racksackserveruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|racksackserveruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: racksackserveruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"racksackserveruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])racksackserveruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: rackserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rackserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353651; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: rackserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rackserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353652; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: rackserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"rackserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])rackserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353653; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: readmytipsntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|readmytipsntricks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: readmytipsntricks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|readmytipsntricks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: readmytipsntricks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"readmytipsntricks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])readmytipsntricks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: redirectonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|redirectonline|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: redirectonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|redirectonline|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: redirectonline.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"redirectonline.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])redirectonline\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: redirectserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|redirectserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: redirectserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|redirectserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: redirectserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"redirectserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])redirectserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: registrationonlineeurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|registrationonlineeurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356711; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: registrationonlineeurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|registrationonlineeurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356712; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: registrationonlineeurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"registrationonlineeurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])registrationonlineeurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356713; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: rockerhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|rockerhostings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354621; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: rockerhostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|rockerhostings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354622; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: rockerhostings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"rockerhostings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])rockerhostings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354623; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: rulinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rulinuxbasic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: rulinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rulinuxbasic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: rulinuxbasic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"rulinuxbasic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])rulinuxbasic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ruslinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|ruslinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356051; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ruslinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|ruslinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356052; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ruslinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ruslinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ruslinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356053; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: russialinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|russialinuxbasic|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: russialinuxbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|russialinuxbasic|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: russialinuxbasic.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"russialinuxbasic.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])russialinuxbasic\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: saferedirect.pw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|saferedirect|02|pw|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357781; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: saferedirect.pw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|saferedirect|02|pw|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357782; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: saferedirect.pw"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"saferedirect.pw"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])saferedirect\.pw[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357783; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: santanaservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|santanaservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: santanaservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|santanaservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: santanaservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"santanaservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])santanaservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserver39j.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sapserver39j|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353331; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserver39j.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sapserver39j|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353332; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserver39j.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserver39j.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserver39j\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353333; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserverhg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sapserverhg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserverhg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sapserverhg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserverhg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserverhg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserverhg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserverhike.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhike|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354921; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserverhike.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhike|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354922; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserverhike.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserverhike.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserverhike\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354923; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: sapserverhipe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhipe|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353991; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: sapserverhipe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sapserverhipe|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353992; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sapserverhipe.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sapserverhipe.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sapserverhipe\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353993; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353961; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353962; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: searchsimple.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"searchsimple.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])searchsimple\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353963; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: searchsimple.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|searchsimple|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: searchsimple.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"searchsimple.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])searchsimple\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: secureemailserver65.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|secureemailserver65|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureemailserver65.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|secureemailserver65|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureemailserver65.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureemailserver65.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureemailserver65\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: securemailhost46.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|securemailhost46|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: securemailhost46.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|securemailhost46|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: securemailhost46.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"securemailhost46.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])securemailhost46\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: secureserver9898.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserver9898|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureserver9898.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserver9898|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureserver9898.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureserver9898.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureserver9898\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: secureserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserverasia|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureserverasia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|secureserverasia|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureserverasia.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureserverasia.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureserverasia\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: secureservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|secureservereurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: secureservereurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|secureservereurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: secureservereurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"secureservereurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])secureservereurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedmaxstores.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedmaxstores|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356901; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedmaxstores.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedmaxstores|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356902; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedmaxstores.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedmaxstores.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedmaxstores\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356903; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicemy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedservicemy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicemy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedservicemy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedservicemy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedservicemy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedserviceru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedserviceru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedserviceru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedserviceru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedserviceru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedserviceru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: selectedservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicesg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectedservicesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|selectedservicesg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectedservicesg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectedservicesg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectedservicesg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: selectiveservicemax.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|selectiveservicemax|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357031; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectiveservicemax.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|selectiveservicemax|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357032; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectiveservicemax.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectiveservicemax.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectiveservicemax\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357033; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: selectyourgroom.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|selectyourgroom|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: selectyourgroom.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|selectyourgroom|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: selectyourgroom.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"selectyourgroom.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])selectyourgroom\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverasiasap.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverasiasap|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356751; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverasiasap.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverasiasap|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356752; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverasiasap.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverasiasap.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverasiasap\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356753; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverdemoservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverdemoservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverdemoservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverdemoservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverdemoservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverdemoservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelphk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelphk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelphk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelphk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelphk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelphk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelphk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelplux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverforhelplux|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357731; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelplux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverforhelplux|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357732; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelplux.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelplux.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelplux\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357733; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357741; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357742; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelpmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelpmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelpmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357743; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelpru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelpru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelpru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpsg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356151; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhelpsg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforhelpsg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356152; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhelpsg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhelpsg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhelpsg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356153; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhiretech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverforhiretech|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhiretech.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverforhiretech|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhiretech.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhiretech.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhiretech\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforhome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverforhome|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356641; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforhome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverforhome|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356642; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforhome.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforhome.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforhome\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356643; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverformailings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverformailings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356501; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverformailings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverformailings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356502; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverformailings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverformailings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverformailings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356503; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverfornetworks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfornetworks|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356511; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverfornetworks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfornetworks|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356512; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverfornetworks.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverfornetworks.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverfornetworks\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356513; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforshort.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|serverforshort|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforshort.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|serverforshort|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforshort.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforshort.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforshort\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfortechhelp|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356601; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverfortechhelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverfortechhelp|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356602; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverfortechhelp.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverfortechhelp.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverfortechhelp\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356603; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverfortechies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverfortechies|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverfortechies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|serverfortechies|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverfortechies.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverfortechies.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverfortechies\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverforzapper.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforzapper|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverforzapper.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|serverforzapper|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverforzapper.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverforzapper.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverforzapper\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: servergateway33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354131; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: servergateway33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354132; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servergateway33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servergateway33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servergateway33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354133; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: servergateway56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway56|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: servergateway56.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servergateway56|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servergateway56.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servergateway56.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servergateway56\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverhello54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverhello54|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverhello54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serverhello54|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverhello54.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverhello54.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverhello54\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serverloadbalance.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverloadbalance|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serverloadbalance.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|serverloadbalance|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serverloadbalance.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serverloadbalance.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serverloadbalance\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: servermailing34.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servermailing34|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: servermailing34.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servermailing34|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servermailing34.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servermailing34.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servermailing34\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: servermain43.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|servermain43|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: servermain43.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|servermain43|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servermain43.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servermain43.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servermain43\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: servermappingserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|servermappingserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: servermappingserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|1a|servermappingserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servermappingserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servermappingserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servermappingserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serversap54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|serversap54|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354911; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serversap54.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|serversap54|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354912; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serversap54.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serversap54.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serversap54\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354913; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serviceasneed.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serviceasneed|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355881; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serviceasneed.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serviceasneed|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355882; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serviceasneed.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serviceasneed.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serviceasneed\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355883; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: serviceforneworder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|serviceforneworder|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: serviceforneworder.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|serviceforneworder|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: serviceforneworder.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"serviceforneworder.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])serviceforneworder\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: servicegoingfar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servicegoingfar|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: servicegoingfar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|servicegoingfar|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: servicegoingfar.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"servicegoingfar.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])servicegoingfar\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: sglinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|sglinbas|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356061; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: sglinbas.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|sglinbas|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356062; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sglinbas.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sglinbas.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sglinbas\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356063; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shadymario.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shadymario|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353351; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shadymario.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shadymario|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353352; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shadymario.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shadymario.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shadymario\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353353; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shipnyatchholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shipnyatchholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355301; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shipnyatchholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shipnyatchholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355302; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shipnyatchholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shipnyatchholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shipnyatchholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355303; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreesg|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreesg.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreesg|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shoponlinefreesg.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shoponlinefreesg.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shoponlinefreesg\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreeuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356211; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shoponlinefreeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|shoponlinefreeuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356212; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shoponlinefreeuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shoponlinefreeuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shoponlinefreeuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356213; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: short-ner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|short-ner|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: short-ner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|short-ner|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: short-ner.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"short-ner.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])short\-ner\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortenup.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|shortenup|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortenup.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|shortenup|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortenup.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortenup.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortenup\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortenurlservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|shortenurlservices|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortenurlservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|shortenurlservices|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortenurlservices.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortenurlservices.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortenurlservices\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353401; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353402; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortformurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortformurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortformurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353403; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353411; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortformurl.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortformurl|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353412; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortformurl.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortformurl.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortformurl\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353413; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortlinkcut.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortlinkcut|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354761; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortlinkcut.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortlinkcut|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354762; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortlinkcut.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortlinkcut.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortlinkcut\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354763; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortnerserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|shortnerserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356011; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortnerserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|shortnerserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356012; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortnerserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortnerserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortnerserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356013; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shortserver1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortserver1|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shortserver1.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|shortserver1|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shortserver1.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shortserver1.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shortserver1\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shorturlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|shorturlservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shorturlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|shorturlservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shorturlservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shorturlservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shorturlservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shrinkandshareurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shrinkandshareurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shrinkandshareurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|shrinkandshareurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shrinkandshareurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shrinkandshareurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shrinkandshareurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shrinkthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|shrinkthisurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shrinkthisurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|shrinkthisurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shrinkthisurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shrinkthisurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shrinkthisurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: shrtnerlnk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shrtnerlnk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: shrtnerlnk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|shrtnerlnk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: shrtnerlnk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"shrtnerlnk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])shrtnerlnk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: siteadmineurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|siteadmineurope|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357271; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: siteadmineurope.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|siteadmineurope|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357272; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: siteadmineurope.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"siteadmineurope.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])siteadmineurope\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357273; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: siteadminhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|siteadminhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357241; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: siteadminhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|siteadminhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357242; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: siteadminhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"siteadminhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])siteadminhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357243; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: sitebloginfo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sitebloginfo|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: sitebloginfo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|sitebloginfo|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: sitebloginfo.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"sitebloginfo.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])sitebloginfo\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: smtpserver389.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver389|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353201; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: smtpserver389.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver389|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353202; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: smtpserver389.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"smtpserver389.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])smtpserver389\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353203; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: smtpserver466.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver466|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: smtpserver466.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|smtpserver466|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: smtpserver466.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"smtpserver466.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])smtpserver466\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: snaphosterservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|snaphosterservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: snaphosterservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|snaphosterservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: snaphosterservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"snaphosterservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])snaphosterservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: softnetworksolutions.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|softnetworksolutions|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: softnetworksolutions.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|softnetworksolutions|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: softnetworksolutions.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"softnetworksolutions.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])softnetworksolutions\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: softredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|softredirect|04|info|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: softredirect.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|softredirect|04|info|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: softredirect.info"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"softredirect.info"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])softredirect\.info[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: srtnr.co"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|02|co|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353591; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: srtnr.co"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|02|co|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353592; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: srtnr.co"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"srtnr.co"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])srtnr\.co[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353593; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: srtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353801; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: srtnr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|srtnr|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353802; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: srtnr.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"srtnr.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])srtnr\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353803; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: srvrgruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|srvrgruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355491; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: srvrgruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|srvrgruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355492; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: srvrgruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"srvrgruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])srvrgruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355493; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: standardofficeholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|standardofficeholland|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356461; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: standardofficeholland.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|standardofficeholland|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356462; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: standardofficeholland.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"standardofficeholland.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])standardofficeholland\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356463; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: standardofficeil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeil|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356471; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: standardofficeil.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeil|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356472; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: standardofficeil.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"standardofficeil.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])standardofficeil\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356473; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: standardofficeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356481; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: standardofficeuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|standardofficeuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356482; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: standardofficeuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"standardofficeuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])standardofficeuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356483; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: strngbltru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|strngbltru|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356231; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: strngbltru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|strngbltru|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356232; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strngbltru.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strngbltru.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strngbltru\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356233; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: strongbolthostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|strongbolthostinghk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: strongbolthostinghk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|strongbolthostinghk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strongbolthostinghk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strongbolthostinghk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strongbolthostinghk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: strongwingtechnologies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|strongwingtechnologies|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: strongwingtechnologies.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|16|strongwingtechnologies|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strongwingtechnologies.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strongwingtechnologies.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strongwingtechnologies\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: strurl.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|strurl|05|click|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354661; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: strurl.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|strurl|05|click|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354662; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: strurl.click"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"strurl.click"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])strurl\.click[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354663; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: supportserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|supportserviceeu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357081; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: supportserviceeu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|supportserviceeu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357082; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: supportserviceeu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"supportserviceeu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])supportserviceeu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357083; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: tineeurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|tineeurl|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356721; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: tineeurl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|tineeurl|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356722; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tineeurl.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tineeurl.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tineeurl\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356723; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: tinyurlshortner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|tinyurlshortner|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356981; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: tinyurlshortner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|tinyurlshortner|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356982; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tinyurlshortner.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tinyurlshortner.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tinyurlshortner\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356983; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: tnyurlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|tnyurlservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355521; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: tnyurlservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|tnyurlservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355522; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tnyurlservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tnyurlservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tnyurlservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355523; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: trackserviceonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trackserviceonline|03|xyz|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355121; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: trackserviceonline.xyz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trackserviceonline|03|xyz|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355122; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: trackserviceonline.xyz"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"trackserviceonline.xyz"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])trackserviceonline\.xyz[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355123; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: transferdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356171; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356172; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferdomainhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferdomainhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferdomainhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356173; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: transferdomainlu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainlu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferdomainlu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainlu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferdomainlu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferdomainlu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferdomainlu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: transferdomainmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainmy|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356191; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferdomainmy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferdomainmy|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356192; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferdomainmy.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferdomainmy.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferdomainmy\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356193; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: transferserver33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferserver33|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357691; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: transferserver33.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|transferserver33|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357692; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: transferserver33.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"transferserver33.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])transferserver33\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357693; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: tricktravelbooking.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|tricktravelbooking|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355321; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: tricktravelbooking.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|tricktravelbooking|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355322; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: tricktravelbooking.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"tricktravelbooking.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])tricktravelbooking\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355323; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: trustedserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|trustedserviceonline|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356861; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: trustedserviceonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|trustedserviceonline|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356862; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: trustedserviceonline.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"trustedserviceonline.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])trustedserviceonline\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356863; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: trusteventservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trusteventservices|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: trusteventservices.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|trusteventservices|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: trusteventservices.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"trusteventservices.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])trusteventservices\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ultimateresponseservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|ultimateresponseservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ultimateresponseservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|ultimateresponseservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ultimateresponseservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ultimateresponseservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ultimateresponseservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: ultronnetworksolution.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|ultronnetworksolution|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: ultronnetworksolution.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|ultronnetworksolution|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: ultronnetworksolution.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"ultronnetworksolution.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])ultronnetworksolution\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: un-told.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|un-told|03|net|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353871; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: un-told.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|un-told|03|net|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353872; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: un-told.net"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"un-told.net"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])un\-told\.net[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353873; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: updatenameserver45.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|updatenameserver45|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: updatenameserver45.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|updatenameserver45|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: updatenameserver45.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"updatenameserver45.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])updatenameserver45\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: upgradetravelservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|upgradetravelservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355141; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: upgradetravelservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|upgradetravelservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355142; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: upgradetravelservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"upgradetravelservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])upgradetravelservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355143; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: usewithcareathome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|usewithcareathome|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356631; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: usewithcareathome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|usewithcareathome|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356632; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: usewithcareathome.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"usewithcareathome.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])usewithcareathome\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356633; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: watchmanservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|watchmanservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355371; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: watchmanservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|watchmanservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355372; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: watchmanservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"watchmanservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])watchmanservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355373; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webdomainexperts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webdomainexperts|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355891; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webdomainexperts.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webdomainexperts|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355892; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webdomainexperts.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webdomainexperts.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webdomainexperts\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355893; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webhostwebcare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webhostwebcare|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354791; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webhostwebcare.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webhostwebcare|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354792; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webhostwebcare.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webhostwebcare.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webhostwebcare\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354793; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webmailmanageruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webmailmanageruk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357671; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webmailmanageruk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webmailmanageruk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357672; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webmailmanageruk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webmailmanageruk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webmailmanageruk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357673; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webmasterserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webmasterserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353441; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webmasterserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webmasterserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353442; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webmasterserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webmasterserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webmasterserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353443; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webnetonlineservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webnetonlineservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webnetonlineservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webnetonlineservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webnetonlineservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webnetonlineservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webnetonlineservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webredirect.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webredirect|05|click|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355161; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webredirect.click"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webredirect|05|click|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355162; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webredirect.click"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webredirect.click"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webredirect\.click[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355163; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webredirect39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|webredirect39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1353421; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webredirect39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|webredirect39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1353422; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webredirect39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webredirect39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webredirect39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1353423; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: websecurehostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websecurehostings|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355021; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: websecurehostings.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websecurehostings|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355022; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websecurehostings.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websecurehostings.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websecurehostings\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355023; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver39|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354181; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserver39.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver39|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354182; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserver39.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserver39.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserver39\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354183; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserver39490.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webserver39490|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355531; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserver39490.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|webserver39490|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355532; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserver39490.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserver39490.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserver39490\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355533; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserver91.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver91|07|website|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354001; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserver91.website"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|webserver91|07|website|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354002; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserver91.website"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserver91.website"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserver91\.website[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354003; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomaineu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomaineu|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355551; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomaineu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomaineu|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355552; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomaineu.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomaineu.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomaineu\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355553; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainhk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355561; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainhk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainhk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355562; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomainhk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomainhk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomainhk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355563; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355571; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|webserverdomainuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355572; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomainuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomainuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomainuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355573; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|webserverdomainusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverdomainusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|webserverdomainusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverdomainusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverdomainusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverdomainusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverhollandservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|webserverhollandservice|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354771; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverhollandservice.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|webserverhollandservice|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354772; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverhollandservice.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverhollandservice.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverhollandservice\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354773; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserveroginusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveroginusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1355541; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserveroginusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveroginusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1355542; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserveroginusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserveroginusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserveroginusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1355543; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserveronline9.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveronline9|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354221; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserveronline9.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|webserveronline9|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354222; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserveronline9.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserveronline9.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserveronline9\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354223; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: webserverredirect99.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webserverredirect99|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354281; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: webserverredirect99.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|webserverredirect99|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354282; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: webserverredirect99.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"webserverredirect99.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])webserverredirect99\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354283; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: websiteadminuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|websiteadminuk|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357701; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: websiteadminuk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|websiteadminuk|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357702; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websiteadminuk.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websiteadminuk.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websiteadminuk\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357703; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: websitemanagerusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websitemanagerusa|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357681; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: websitemanagerusa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|websitemanagerusa|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357682; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websitemanagerusa.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websitemanagerusa.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websitemanagerusa\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357683; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: websociofiles.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|websociofiles|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1354071; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: websociofiles.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|websociofiles|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1354072; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: websociofiles.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"websociofiles.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])websociofiles\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1354073; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: xpertdomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|xpertdomain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357291; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: xpertdomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|xpertdomain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357292; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: xpertdomain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"xpertdomain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])xpertdomain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357293; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: xpertmaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|xpertmaildomain|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356451; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: xpertmaildomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|xpertmaildomain|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356452; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: xpertmaildomain.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"xpertmaildomain.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])xpertmaildomain\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356453; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: youranotherserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|youranotherserver|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1356581; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: youranotherserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|youranotherserver|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1356582; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: youranotherserver.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"youranotherserver.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])youranotherserver\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1356583; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert udp any any -> any 53 (msg: "Dark Basin Domain: zsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|zsrvrer|03|com|00|"; fast_pattern; nocase; classtype:trojan-activity; sid:1357361; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp any any -> any 53 (msg: "Dark Basin Domain: zsrvrer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|zsrvrer|03|com|00|"; fast_pattern; nocase; flow:established; classtype:trojan-activity; sid:1357362; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg: "Dark Basin Outgoing HTTP Domain: zsrvrer.com"; flow:to_server,established; content: "Host|3a|"; nocase; http_header; content:"zsrvrer.com"; nocase; http_header; pcre: "/(^|[^A-Za-z0-9-])zsrvrer\.com[^A-Za-z0-9-\.]/H"; tag:session,600,seconds; classtype:trojan-activity; sid:1357363; rev:1; priority:1; reference:url,https://citizenlab.ca/2020/06/dark-basin-uncovering-a-massive-hack-for-hire-operation/;)
#
Reference in New Issue View Git Blame Copy Permalink