-
Notifications
You must be signed in to change notification settings - Fork 18
/
dyndns-dns.rules
1150 lines (1150 loc) · 302 KB
/
dyndns-dns.rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain flashserv.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|flashserv|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110000; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain xns01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|xns01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110001; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain dnsdynamic.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dnsdynamic|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110002; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain dnsget.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dnsget|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110003; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain proxy8080.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|proxy8080|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110004; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain mysq1.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mysq1|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110005; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain http01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|http01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110006; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ssh01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ssh01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110007; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain user32.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|user32|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110008; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ttl60.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ttl60|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110009; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ddns01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ddns01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110010; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain fe100.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|fe100|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110011; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain imap01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|imap01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110012; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain craftx.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|craftx|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110013; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ns360.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ns360|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110014; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ttl60.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ttl60|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110015; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain x64.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|x64|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110016; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain tempors.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|tempors|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110017; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain https443.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|https443|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110018; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain tftpd.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|tftpd|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110019; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain wow64.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|wow64|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110020; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain dnsapi.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dnsapi|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110021; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain kadm5.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|kadm5|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110022; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain voip01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|voip01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110023; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ssh22.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ssh22|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110024; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ftp21.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ftp21|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110025; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ntdll.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ntdll|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110026; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain dns53.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dns53|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110027; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain dnsd.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dnsd|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110028; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain sql01.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|sql01|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110029; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain ole32.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ole32|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110030; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain adultdns.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|adultdns|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110031; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSDYNAMIC.ORG domain http80.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|http80|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110032; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain blogsyte.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|blogsyte|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110033; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain brasilia.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|brasilia|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110034; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain cable-modem.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|cable-modem|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110035; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ciscofreak.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|ciscofreak|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110036; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain collegefan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|collegefan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110037; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain couchpotatofries.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|couchpotatofries|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110038; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain damnserver.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|damnserver|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110039; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ddns.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ddns|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110040; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ditchyourip.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|ditchyourip|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110041; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain dnsfor.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dnsfor|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110042; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain dnsiskinky.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dnsiskinky|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110043; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain dvrcam.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dvrcam|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110044; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain dynns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dynns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110045; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain eating-organic.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|eating-organic|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110046; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain fantasyleague.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|fantasyleague|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110047; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain geekgalaxy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|geekgalaxy|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110048; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain golffan.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|golffan|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110049; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain health-carereform.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|health-carereform|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110050; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain homesecuritymac.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|homesecuritymac|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110051; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain homesecuritypc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|homesecuritypc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110052; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain hopto.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|hopto|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110053; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ilovecollege.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ilovecollege|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110054; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain loginto.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|loginto|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110055; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mlbfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mlbfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110056; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mmafan.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mmafan|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110057; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain myactivedirectory.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|myactivedirectory|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110058; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mydissent.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mydissent|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110059; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain myeffect.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|myeffect|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110060; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mymediapc.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|mymediapc|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110061; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mypsx.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mypsx|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110062; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mysecuritycamera.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mysecuritycamera|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110063; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mysecuritycamera.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mysecuritycamera|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110064; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain mysecuritycamera.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mysecuritycamera|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110065; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain net-freaks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|net-freaks|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110066; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain nflfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|nflfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110067; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain nhlfan.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|nhlfan|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110068; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain no-ip.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|no-ip|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110069; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain no-ip.co.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|no-ip|02|co|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110070; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain no-ip.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|no-ip|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110071; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain noip.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|noip|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110072; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain pgafan.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|pgafan|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110073; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain point2this.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|point2this|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110074; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain pointto.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|pointto|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110075; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain privatizehealthinsurance.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|18|privatizehealthinsurance|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110076; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain quicksytes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|quicksytes|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110077; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain read-books.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|read-books|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110078; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain securityexploits.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|securityexploits|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110079; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain securitytactics.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|securitytactics|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110080; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain serveexchange.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|serveexchange|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110081; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servehumour.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|servehumour|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110082; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servep2p.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|servep2p|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110083; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servesarcasm.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|servesarcasm|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110084; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain stufftoread.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|stufftoread|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110085; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ufcfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ufcfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110086; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain unusualperson.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|unusualperson|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110087; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain workisboring.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|workisboring|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110088; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain 3utilities.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|3utilities|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110089; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain bounceme.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|bounceme|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110090; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ddns.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ddns|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110091; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain ddnsking.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|ddnsking|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110092; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain gotdns.ch"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|gotdns|02|ch|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110093; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain hopto.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|hopto|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110094; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain myftp.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|myftp|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110095; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain myftp.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|myftp|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110096; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain myvnc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|myvnc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110097; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain no-ip.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|no-ip|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110098; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain no-ip.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|no-ip|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110099; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain no-ip.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|no-ip|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110100; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain noip.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|noip|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110101; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain redirectme.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|redirectme|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110102; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servebeer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|servebeer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110103; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain serveblog.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|serveblog|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110104; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servecounterstrike.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|servecounterstrike|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110105; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain serveftp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|serveftp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110106; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servegame.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|servegame|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110107; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servehalflife.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|servehalflife|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110108; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servehttp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|servehttp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110109; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain serveminecraft.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|serveminecraft|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110110; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servemp3.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|servemp3|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110111; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servepics.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|servepics|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110112; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain servequake.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|servequake|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110113; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain sytes.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|sytes|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110114; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain webhop.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|webhop|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110115; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query NOIP domain zapto.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|zapto|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110116; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain at-band-camp.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|at-band-camp|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110117; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain barrel-of-knowledge.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|barrel-of-knowledge|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110118; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain barrell-of-knowledge.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|barrell-of-knowledge|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110119; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain better-than.tv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|better-than|02|tv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110120; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain blogdns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|blogdns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110121; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain blogdns.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|blogdns|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110122; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain blogdns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|blogdns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110123; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain blogsite.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|blogsite|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110124; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain boldlygoingnowhere.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|boldlygoingnowhere|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110125; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain broke-it.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|broke-it|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110126; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain buyshouses.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|buyshouses|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110127; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain cechire.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|cechire|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110128; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dnsalias.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dnsalias|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110129; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dnsalias.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dnsalias|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110130; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dnsalias.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dnsalias|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110131; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dnsdojo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dnsdojo|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110132; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dnsdojo.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dnsdojo|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110133; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dnsdojo.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dnsdojo|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110134; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain does-it.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|does-it|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110135; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain doesntexist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|doesntexist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110136; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain doesntexist.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|doesntexist|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110137; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dontexist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|dontexist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110138; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dontexist.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|dontexist|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110139; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dontexist.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|dontexist|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110140; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain doomdns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|doomdns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110141; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain doomdns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|doomdns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110142; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dvrdns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dvrdns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110143; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyn-o-saur.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dyn-o-saur|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110144; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dynalias.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dynalias|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110145; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dynalias.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dynalias|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110146; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dynalias.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dynalias|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110147; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dynathome.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|dynathome|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110148; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-at-home.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dyndns-at-home|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110149; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-at-work.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|dyndns-at-work|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110150; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-blog.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-blog|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110151; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-free.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-free|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110152; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-home.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-home|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110153; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-ip.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|dyndns-ip|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110154; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-mail.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-mail|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110155; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-office.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|dyndns-office|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110156; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-pics.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-pics|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110157; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-remote.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|dyndns-remote|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110158; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-server.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|dyndns-server|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110159; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-web.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dyndns-web|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110160; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-wiki.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-wiki|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110161; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns-work.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|dyndns-work|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110162; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dyndns|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110163; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dyndns|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110164; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dyndns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110165; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns.tv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dyndns|02|tv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110166; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain dyndns.ws"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dyndns|02|ws|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110167; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain endofinternet.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|endofinternet|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110168; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain endofinternet.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|endofinternet|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110169; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain endoftheinternet.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|endoftheinternet|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110170; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain est-a-la-maison.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|est-a-la-maison|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110171; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain est-a-la-masion.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|est-a-la-masion|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110172; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain est-le-patron.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|est-le-patron|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110173; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain est-mon-blogueur.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|est-mon-blogueur|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110174; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain for-better.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|for-better|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110175; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain for-more.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|for-more|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110176; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain for-our.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|for-our|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110177; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain for-some.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|for-some|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110178; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain for-the.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|for-the|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110179; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain forgot.her.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|forgot|03|her|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110180; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain forgot.his.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|forgot|03|his|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110181; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ak.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ak|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110182; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-al.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-al|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110183; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ar|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110184; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-az.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-az|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110185; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ca.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ca|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110186; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-co.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-co|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110187; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ct.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ct|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110188; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-dc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-dc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110189; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-de.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-de|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110190; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-fl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-fl|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110191; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ga.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ga|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110192; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-hi.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-hi|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110193; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ia.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ia|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110194; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-id.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-id|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110195; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-il.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-il|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110196; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-in.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-in|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110197; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ks|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110198; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ky.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ky|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110199; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-la.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-la|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110200; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ma.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ma|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110201; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-md.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-md|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110202; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-me.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-me|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110203; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-mi.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-mi|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110204; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-mn.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-mn|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110205; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-mo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-mo|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110206; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ms.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ms|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110207; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-mt.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-mt|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110208; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-nc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-nc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110209; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-nd.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-nd|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110210; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ne.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ne|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110211; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-nh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-nh|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110212; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-nj.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-nj|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110213; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-nm.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-nm|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110214; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-nv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-nv|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110215; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ny.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ny|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110216; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-oh.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-oh|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110217; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ok.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ok|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110218; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-or.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-or|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110219; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-pa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-pa|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110220; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-pr.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-pr|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110221; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ri.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ri|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110222; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-sc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-sc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110223; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-sd.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-sd|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110224; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-tn.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-tn|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110225; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-tx.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-tx|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110226; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-ut.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-ut|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110227; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-va.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-va|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110228; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-vt.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-vt|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110229; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-wa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-wa|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110230; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-wi.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-wi|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110231; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-wv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-wv|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110232; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain from-wy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|from-wy|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110233; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain ftpaccess.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|ftpaccess|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110234; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain fuettertdasnetz.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|fuettertdasnetz|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110235; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain game-host.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|game-host|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110236; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain game-server.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|game-server|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110237; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain getmyip.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|getmyip|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110238; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain gets-it.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|gets-it|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110239; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain go.dyndns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|go|06|dyndns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110240; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain gotdns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|gotdns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110241; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain gotdns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|gotdns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110242; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain groks-the.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|groks-the|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110243; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain groks-this.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|groks-this|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110244; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain ham-radio-op.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|ham-radio-op|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110245; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain here-for-more.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|here-for-more|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110246; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain hobby-site.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hobby-site|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110247; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain hobby-site.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hobby-site|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110248; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain home.dyndns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|home|06|dyndns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110249; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homedns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|homedns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110250; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homeftp.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|homeftp|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110251; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homeftp.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|homeftp|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110252; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homeip.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|homeip|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110253; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homelinux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|homelinux|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110254; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homelinux.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|homelinux|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110255; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homelinux.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|homelinux|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110256; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homeunix.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|homeunix|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110257; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homeunix.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|homeunix|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110258; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain homeunix.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|homeunix|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110259; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain iamallama.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|iamallama|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110260; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain in-the-band.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|in-the-band|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110261; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-anarchist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-anarchist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110262; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-blogger.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-blogger|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110263; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-bookkeeper.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-a-bookkeeper|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110264; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-bruinsfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-bruinsfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110265; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-bulls-fan.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-bulls-fan|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110266; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-candidate.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-candidate|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110267; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-caterer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-caterer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110268; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-celticsfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-a-celticsfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110269; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-chef.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-chef|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110270; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-chef.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-chef|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110271; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-chef.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-chef|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110272; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-conservative.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|is-a-conservative|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110273; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-cpa.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|is-a-cpa|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110274; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-cubicle-slave.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|is-a-cubicle-slave|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110275; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-democrat.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-a-democrat|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110276; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-designer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-a-designer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110277; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-doctor.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-doctor|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110278; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-financialadvisor.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|15|is-a-financialadvisor|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110279; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-geek.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-geek|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110280; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-geek.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-geek|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110281; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-geek.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-geek|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110282; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-green.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|is-a-green|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110283; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-guru.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|is-a-guru|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110284; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-hard-worker.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|is-a-hard-worker|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110285; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-hunter.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-hunter|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110286; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-knight.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-knight|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110287; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-landscaper.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-a-landscaper|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110288; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-lawyer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-lawyer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110289; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-liberal.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-liberal|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110290; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-libertarian.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|is-a-libertarian|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110291; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-linux-user.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-a-linux-user|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110292; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-llama.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|is-a-llama|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110293; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-musician.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-a-musician|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110294; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-nascarfan.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-nascarfan|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110295; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-nurse.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|is-a-nurse|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110296; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-painter.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-painter|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110297; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-patsfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-patsfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110298; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-personaltrainer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|is-a-personaltrainer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110299; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-photographer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|is-a-photographer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110300; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-player.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-player|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110301; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-republican.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-a-republican|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110302; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-rockstar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-a-rockstar|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110303; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-socialist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-socialist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110304; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-soxfan.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-soxfan|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110305; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-student.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-student|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110306; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-teacher.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-a-teacher|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110307; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-techie.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-a-techie|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110308; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-a-therapist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-a-therapist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110309; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-accountant.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|is-an-accountant|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110310; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-actor.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-an-actor|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110311; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-actress.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-an-actress|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110312; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-anarchist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-an-anarchist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110313; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-artist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-an-artist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110314; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-engineer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|is-an-engineer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110315; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-an-entertainer.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|is-an-entertainer|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110316; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-by.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|is-by|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110317; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-certified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-certified|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110318; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-found.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|is-found|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110319; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-gone.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|is-gone|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110320; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-into-anime.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-into-anime|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110321; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-into-cars.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-into-cars|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110322; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-into-cartoons.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|is-into-cartoons|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110323; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-into-games.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-into-games|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110324; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-leet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|is-leet|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110325; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-lost.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|is-lost|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110326; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-not-certified.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|is-not-certified|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110327; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-saved.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|is-saved|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110328; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-slick.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|is-slick|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110329; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-uberleet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-uberleet|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110330; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-very-bad.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|is-very-bad|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110331; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-very-evil.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-very-evil|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110332; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-very-good.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-very-good|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110333; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-very-nice.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|is-very-nice|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110334; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-very-sweet.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|is-very-sweet|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110335; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain is-with-theband.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|is-with-theband|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110336; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain isa-geek.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|isa-geek|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110337; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain isa-geek.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|isa-geek|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110338; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain isa-geek.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|isa-geek|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110339; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain isa-hockeynut.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|isa-hockeynut|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110340; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain issmarterthanyou.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|issmarterthanyou|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110341; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain isteingeek.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|isteingeek|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110342; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain istmein.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|istmein|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110343; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain kicks-ass.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|kicks-ass|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110344; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain kicks-ass.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|kicks-ass|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110345; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain knowsitall.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|knowsitall|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110346; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain land-4-sale.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|land-4-sale|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110347; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain lebtimnetz.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|lebtimnetz|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110348; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain leitungsen.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|leitungsen|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110349; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain likes-pie.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|likes-pie|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110350; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain likescandy.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|likescandy|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110351; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain merseine.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|merseine|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110352; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain mine.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|mine|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110353; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain misconfused.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|misconfused|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110354; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain mypets.ws"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mypets|02|ws|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110355; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain myphotos.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|myphotos|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110356; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain neat-url.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|neat-url|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110357; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain office-on-the.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|office-on-the|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110358; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain on-the-web.tv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|on-the-web|02|tv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110359; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain podzone.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|podzone|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110360; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain podzone.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|podzone|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110361; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain readmyblog.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|readmyblog|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110362; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain saves-the-whales.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|saves-the-whales|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110363; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain scrapper-site.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|scrapper-site|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110364; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain scrapping.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|scrapping|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110365; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain selfip.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|selfip|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110366; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain selfip.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|selfip|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110367; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain selfip.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|selfip|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110368; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain selfip.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|selfip|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110369; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain selfip.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|selfip|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110370; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain sells-for-less.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|sells-for-less|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110371; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain sells-for-u.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sells-for-u|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110372; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain sells-it.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|sells-it|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110373; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain sellsyourhome.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|sellsyourhome|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110374; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain servebbs.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|servebbs|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110375; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain servebbs.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|servebbs|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110376; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain servebbs.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|servebbs|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110377; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain serveftp.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|serveftp|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110378; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain serveftp.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|serveftp|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110379; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain servegame.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|servegame|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110380; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain shacknet.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|shacknet|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110381; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain simple-url.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|simple-url|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110382; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain space-to-rent.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|space-to-rent|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110383; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain stuff-4-sale.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|stuff-4-sale|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110384; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain stuff-4-sale.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|stuff-4-sale|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110385; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain teaches-yoga.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|teaches-yoga|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110386; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain thruhere.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|thruhere|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110387; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain traeumtgerade.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|traeumtgerade|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110388; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain webhop.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|webhop|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110389; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain webhop.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|webhop|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110390; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain webhop.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|webhop|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110391; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain webhop.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|webhop|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110392; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain worse-than.tv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|worse-than|02|tv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110393; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DYN.com domain writesthisblog.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|writesthisblog|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110394; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSEXIT.com domain publicvm.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|publicvm|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110395; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DNSEXIT.com domain linkpc.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|linkpc|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110396; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mooo.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|mooo|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110397; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain chickenkiller.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|chickenkiller|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110398; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain us.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|us|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110399; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain strangled.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|strangled|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110400; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ignorelist.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|ignorelist|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110401; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain uk.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|uk|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110402; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain crabdance.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|crabdance|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110403; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain info.tm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|info|02|tm|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110404; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain homenet.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|homenet|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110405; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jumpingcrab.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|jumpingcrab|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110406; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain twilightparadox.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|twilightparadox|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110407; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain biz.tm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|biz|02|tm|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110408; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain continent.kz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|continent|02|kz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110409; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain yao.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|yao|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110410; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ax.lt"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|ax|02|lt|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110411; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain privatedns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|privatedns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110412; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hacked.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|hacked|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110413; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ftp.sh"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ftp|02|sh|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110414; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain now.im"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|now|02|im|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110415; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bep.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|bep|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110416; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain undo.it"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|undo|02|it|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110417; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bot.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|bot|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110418; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kalbas.com.vn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|kalbas|03|com|02|vn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110419; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain qc.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|qc|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110420; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 3dxtras.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|3dxtras|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110421; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain pwnz.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|pwnz|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110422; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mine.bz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|mine|02|bz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110423; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dynet.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dynet|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110424; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain info.gf"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|info|02|gf|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110425; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain my.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|my|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110426; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain allowed.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|allowed|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110427; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain god.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|god|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110428; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain home.kg"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|home|02|kg|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110429; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain shop.tm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|shop|02|tm|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110430; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ro.lt"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|ro|02|lt|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110431; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain t28.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|t28|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110432; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain minecraftnoob.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|minecraftnoob|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110433; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 69.mu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|69|02|mu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110434; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain spacetechnology.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|spacetechnology|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110435; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gw.lt"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|gw|02|lt|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110436; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain root.sx"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|root|02|sx|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110437; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nx.tc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|nx|02|tc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110438; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain k.vu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|01|k|02|vu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110439; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mooo.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|mooo|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110440; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain farted.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|farted|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110441; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain minecraftr.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|minecraftr|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110442; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain port0.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|port0|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110443; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain happyforever.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|happyforever|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110444; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cr.rs"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|cr|02|rs|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110445; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bigbox.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|bigbox|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110446; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 1337.cx"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|1337|02|cx|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110447; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain evils.in"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|evils|02|in|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110448; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain csproject.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|csproject|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110449; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain verymad.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|verymad|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110450; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain fr.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|fr|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110451; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain serverpit.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|serverpit|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110452; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vr.lt"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|vr|02|lt|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110453; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain punked.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|punked|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110454; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain suka.se"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|suka|02|se|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110455; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain h4ck.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|h4ck|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110456; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain soon.it"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|soon|02|it|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110457; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain thcgirls.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|thcgirls|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110458; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain iz.rs"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|iz|02|rs|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110459; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain madhacker.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|madhacker|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110460; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain fedea.com.ar"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|fedea|03|com|02|ar|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110461; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain icfar.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|icfar|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110462; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain r-o-o-t.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|r-o-o-t|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110463; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 404.mn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|404|02|mn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110464; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kir22.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|kir22|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110465; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain byte4byte.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|byte4byte|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110466; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 120v.ac"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|120v|02|ac|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110467; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain d-n-s.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|d-n-s|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110468; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain h-o-s-t.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|h-o-s-t|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110469; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain psybnc.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|psybnc|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110470; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain zanity.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|zanity|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110471; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hashcube.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|hashcube|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110472; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ohbah.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ohbah|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110473; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 24-7.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|24-7|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110474; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mm.my"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|mm|02|my|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110475; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain iiiii.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|iiiii|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110476; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain abuser.eu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|abuser|02|eu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110477; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain star.is"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|star|02|is|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110478; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain epicgamer.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|epicgamer|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110479; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vietnam.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|vietnam|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110480; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hackquest.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|hackquest|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110481; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain photo-frame.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|photo-frame|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110482; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain iminecraft.se"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|iminecraft|02|se|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110483; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain oo.fi"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|oo|02|fi|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110484; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain javafaq.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|javafaq|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110485; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bestforever.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|bestforever|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110486; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain antongorbunov.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|antongorbunov|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110487; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain agropeople.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|agropeople|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110488; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain psp-moscow.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|psp-moscow|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110489; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain crackedsidewalks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|crackedsidewalks|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110490; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain eye.rs"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|eye|02|rs|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110491; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain silksky.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|silksky|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110492; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain drunkensailor.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|drunkensailor|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110493; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain stfu-kthx.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|stfu-kthx|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110494; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain fol.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|fol|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110495; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain baltijalv.lv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|baltijalv|02|lv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110496; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bad.mn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|bad|02|mn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110497; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hpc.tw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|hpc|02|tw|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110498; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nard.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|nard|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110499; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain coalnet.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|coalnet|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110500; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bagus.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|bagus|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110501; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain xpresit.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|xpresit|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110502; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain zvezdaringa.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|zvezdaringa|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110503; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain colegiotamandare.g12.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|colegiotamandare|03|g12|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110504; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain holylandshop.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|holylandshop|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110505; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain homelinuxserver.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|homelinuxserver|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110506; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain violates.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|violates|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110507; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain starkom.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|starkom|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110508; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain pntl.tl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|pntl|02|tl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110509; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dearabba.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dearabba|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110510; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain airlinemeals.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|airlinemeals|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110511; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain zonet.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|zonet|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110512; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain malam.or.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|malam|02|or|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110513; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sektori.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|sektori|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110514; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain freesa.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|freesa|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110515; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mindhackers.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|mindhackers|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110516; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain play.ai"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|play|02|ai|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110517; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain qq.my"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|qq|02|my|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110518; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain joiavip.com.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|joiavip|03|com|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110519; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vivat-consult.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|vivat-consult|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110520; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain oganilirkab.go.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|oganilirkab|02|go|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110521; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kopi.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|kopi|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110522; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain medicost.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|medicost|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110523; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain i-t.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|i-t|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110524; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain routemehome.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|routemehome|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110525; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain good.one.pl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|good|03|one|02|pl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110526; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain playop.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|playop|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110527; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain all.my"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|all|02|my|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110528; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain possessed.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|possessed|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110529; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nav.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|nav|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110530; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain surfnet.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|surfnet|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110531; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain awiki.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|awiki|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110532; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain fairuse.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|fairuse|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110533; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain pce-cihazlari.com.tr"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|pce-cihazlari|03|com|02|tr|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110534; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain violates.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|violates|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110535; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain amurt.org.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|amurt|03|org|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110536; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 3n.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|3n|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110537; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain asenov.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|asenov|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110538; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain funkar.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|funkar|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110539; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hs.vc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|hs|02|vc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110540; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain allisons.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|allisons|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110541; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain empresastaylor.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|empresastaylor|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110542; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain giveawaylisting.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|giveawaylisting|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110543; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain novgaz-rzn.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|novgaz-rzn|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110544; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain fatdiary.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|fatdiary|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110545; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain india.sh"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|india|02|sh|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110546; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain oneindonesia.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|oneindonesia|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110547; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mikata.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mikata|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110548; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain n-e-t.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|n-e-t|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110549; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain host2go.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|host2go|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110550; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hiddencorner.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|hiddencorner|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110551; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain zsh.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|zsh|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110552; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain inflict.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|inflict|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110553; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain quannhacvang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|quannhacvang|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110554; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dhm.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|dhm|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110555; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain maluwilz.lv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|maluwilz|02|lv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110556; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain remoteaccess.me"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|remoteaccess|02|me|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110557; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vankin.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|vankin|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110558; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain raspberryip.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|raspberryip|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110559; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain krash.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|krash|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110560; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain z86.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|z86|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110561; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain erki.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|erki|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110562; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain joe.dj"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|joe|02|dj|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110563; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tacowolf.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|tacowolf|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110564; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cpia.org.ar"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|cpia|03|org|02|ar|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110565; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain netlord.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|netlord|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110566; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cnstefancelmare.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|cnstefancelmare|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110567; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hmao.pro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|hmao|03|pro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110568; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain php-dev.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|php-dev|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110569; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain webs.vc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|webs|02|vc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110570; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bobcentury.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|bobcentury|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110571; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain computersforpeace.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|computersforpeace|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110572; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 688.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|688|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110573; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain richlorenz.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|richlorenz|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110574; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tzafrir.org.il"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|tzafrir|03|org|02|il|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110575; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain galipan.net.ve"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|galipan|03|net|02|ve|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110576; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain h0stname.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|h0stname|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110577; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ddos.im"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ddos|02|im|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110578; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain inedelya.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|inedelya|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110579; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vkagent.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|vkagent|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110580; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cloudwatch.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|cloudwatch|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110581; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sdp-mos.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|sdp-mos|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110582; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain takeshi.cnt.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|takeshi|03|cnt|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110583; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain floripalondon.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|floripalondon|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110584; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain orenznakomstva.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|orenznakomstva|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110585; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 2fine.de"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|2fine|02|de|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110586; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 4040.idv.tw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|4040|03|idv|02|tw|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110587; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain photo-cult.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|photo-cult|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110588; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain winkel.com.ar"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|winkel|03|com|02|ar|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110589; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain juliacake.com.vn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|juliacake|03|com|02|vn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110590; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain eva.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|eva|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110591; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain k22.su"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|k22|02|su|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110592; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tetuku.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|tetuku|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110593; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ananda.net.ve"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ananda|03|net|02|ve|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110594; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain d-n-s.org.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|d-n-s|03|org|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110595; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain blinklab.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|blinklab|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110596; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain pii.at"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|pii|02|at|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110597; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e-data.com.tr"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|e-data|03|com|02|tr|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110598; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tragazorras.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|tragazorras|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110599; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain golf-club.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|golf-club|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110600; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain savage.nu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|savage|02|nu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110601; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain your.my.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|your|02|my|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110602; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nashvillerollergirls.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|nashvillerollergirls|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110603; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 49b.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|49b|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110604; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain stalker.fi"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|stalker|02|fi|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110605; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain uzid.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|uzid|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110606; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain doskapozora.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|doskapozora|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110607; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bloom.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|bloom|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110608; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain smbb.ws"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|smbb|02|ws|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110609; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain stes.fi"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|stes|02|fi|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110610; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mysaol.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mysaol|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110611; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tanah-aina.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|tanah-aina|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110612; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain wiki.gd"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|wiki|02|gd|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110613; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain celebsplay.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|celebsplay|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110614; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain statescasinos.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|statescasinos|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110615; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain stroyexpert.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|stroyexpert|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110616; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ruok.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ruok|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110617; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain id.web.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|id|03|web|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110618; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain openoffcampus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|openoffcampus|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110619; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain bnpt.go.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|bnpt|02|go|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110620; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain forss.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|forss|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110621; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ixx.io"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ixx|02|io|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110622; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mcsoft.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mcsoft|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110623; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain surak.kz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|surak|02|kz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110624; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 0x.no"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|0x|02|no|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110625; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain makny.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|makny|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110626; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain whyboner.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|whyboner|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110627; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ask2ask.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|ask2ask|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110628; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain servernux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|servernux|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110629; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain blizzie.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|blizzie|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110630; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain stan.cn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|stan|02|cn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110631; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain l5.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|l5|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110632; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain good-newz.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|good-newz|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110633; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dmtr.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dmtr|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110634; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain aspserver.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|aspserver|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110635; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain thevaughts.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|thevaughts|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110636; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain uk.ms"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|uk|02|ms|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110637; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain opensrc.mx"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|opensrc|02|mx|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110638; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dalk.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dalk|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110639; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain chebicon.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|chebicon|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110640; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain yngling.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|yngling|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110641; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain stocktester.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|stocktester|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110642; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nedvighimost-sochi.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|nedvighimost-sochi|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110643; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 2p.fm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|2p|02|fm|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110644; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain americajhon.com.pe"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|americajhon|03|com|02|pe|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110645; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kck-saratov.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|kck-saratov|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110646; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain piki.si"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|piki|02|si|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110647; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain benjamin.it"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|benjamin|02|it|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110648; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 4twenty.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|4twenty|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110649; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain erke.biz.tr"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|erke|03|biz|02|tr|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110650; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sextube.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|sextube|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110651; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ddanciu.ro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|ddanciu|02|ro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110652; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain lex.mn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|lex|02|mn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110653; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mychild.ug"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|mychild|02|ug|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110654; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain megamovs.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|megamovs|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110655; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain custom-gaming.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|custom-gaming|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110656; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cda.md"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|cda|02|md|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110657; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain rbb.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|rbb|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110658; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sumibi.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|sumibi|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110659; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hmail.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|hmail|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110660; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ipv6.la"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ipv6|02|la|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110661; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain thegmc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|thegmc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110662; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ig42.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ig42|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110663; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain anonymous.lv"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|anonymous|02|lv|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110664; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dagz.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dagz|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110665; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain istanbulsafak.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|istanbulsafak|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110666; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ormy.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ormy|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110667; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ganino.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ganino|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110668; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cw03.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|cw03|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110669; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain lovethosetrains.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|lovethosetrains|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110670; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain qualirede.com.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|qualirede|03|com|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110671; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain xxxxx.tw"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|xxxxx|02|tw|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110672; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain optimas.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|optimas|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110673; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dyn.ch"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|dyn|02|ch|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110674; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain oldrussianmagic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|oldrussianmagic|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110675; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hbmc.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|hbmc|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110676; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cys.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|cys|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110677; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kyrgyzstan.kg"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|kyrgyzstan|02|kg|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110678; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nevalain.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|nevalain|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110679; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain philipkingsleyshop.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|philipkingsleyshop|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110680; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain darknigger.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|darknigger|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110681; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sne.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|sne|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110682; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dob.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|dob|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110683; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ghostnation.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|ghostnation|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110684; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain beerprojects.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|beerprojects|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110685; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain womenclothingtoday.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|womenclothingtoday|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110686; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain iceblaze.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|iceblaze|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110687; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain iu4ever.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|iu4ever|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110688; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain rixtour.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|rixtour|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110689; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain topdanang.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|topdanang|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110690; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ezxdev.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|ezxdev|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110691; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain heroinewarrior.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|heroinewarrior|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110692; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain grpn.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|grpn|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110693; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain elchemi.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|elchemi|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110694; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain musterihizmetleri.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|musterihizmetleri|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110695; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain playfv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|playfv|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110696; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ccmissoula.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|ccmissoula|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110697; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain blogs.or.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|blogs|02|or|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110698; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e.co.za"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|01|e|02|co|02|za|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110699; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain zhilcontrol.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|zhilcontrol|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110700; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ns22.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ns22|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110701; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain qlbv.vn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|qlbv|02|vn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110702; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain prostore.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|prostore|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110703; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain divakeramika.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|divakeramika|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110704; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sweetriders.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sweetriders|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110705; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain make.com.ar"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|make|03|com|02|ar|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110706; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain smelly.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|smelly|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110707; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain b33r.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|b33r|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110708; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gerastar.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|gerastar|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110709; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tvlinux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|tvlinux|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110710; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain linux70.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|linux70|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110711; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dellsale.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dellsale|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110712; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain lolk.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|lolk|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110713; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain priamaakcia.sk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|priamaakcia|02|sk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110714; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain aintno.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|aintno|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110715; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jcor.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|jcor|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110716; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kein.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|kein|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110717; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain procare.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|procare|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110718; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tv-l.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|tv-l|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110719; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain diipl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|diipl|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110720; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain null.rs"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|null|02|rs|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110721; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain reason.org.nz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|reason|03|org|02|nz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110722; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain happyminecraft.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|happyminecraft|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110723; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain plnntt.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|plnntt|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110724; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain everton.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|everton|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110725; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gurcanozturk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|gurcanozturk|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110726; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jpfiles.eu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|jpfiles|02|eu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110727; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kiani.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|kiani|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110728; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain caturelang.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|caturelang|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110729; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain pckf.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|pckf|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110730; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain trumgame.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|trumgame|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110731; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain brawlcustommusic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|brawlcustommusic|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110732; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dnet.hu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dnet|02|hu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110733; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain innograph.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|innograph|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110734; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sith.su"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|sith|02|su|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110735; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain naru.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|naru|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110736; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 8634.su"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|8634|02|su|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110737; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ivi.pl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ivi|02|pl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110738; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain polissya.eu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|polissya|02|eu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110739; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hitremixes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hitremixes|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110740; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain m-kopa.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|m-kopa|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110741; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain netmask.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|netmask|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110742; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain warmkessel.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|warmkessel|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110743; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hayeshelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|hayeshelp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110744; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain yourspecialtee.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|yourspecialtee|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110745; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain donkeyhot.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|donkeyhot|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110746; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 2ku.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|2ku|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110747; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gebish.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|gebish|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110748; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain russkoeumea.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|russkoeumea|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110749; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain haki.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|haki|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110750; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ilkor.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ilkor|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110751; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mett.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|mett|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110752; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain orskkino.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|orskkino|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110753; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain swsc.org.np"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|swsc|03|org|02|np|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110754; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 150watt.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|150watt|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110755; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dp76.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dp76|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110756; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gtk.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|gtk|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110757; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain privateimport.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|privateimport|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110758; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tedx.ee"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|tedx|02|ee|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110759; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tru.io"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|tru|02|io|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110760; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cc.net.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|cc|03|net|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110761; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain lanas.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|lanas|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110762; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ugo.si"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ugo|02|si|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110763; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain elitter.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|elitter|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110764; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain evs.net.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|evs|03|net|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110765; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jundy.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|jundy|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110766; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nevskayaratusha.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|nevskayaratusha|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110767; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain technopagans.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|technopagans|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110768; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain asianfreshproduce.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|asianfreshproduce|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110769; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hijaxdesigns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|hijaxdesigns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110770; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain morganisageek.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|morganisageek|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110771; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain radiogirl.fm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|radiogirl|02|fm|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110772; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e-education.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|e-education|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110773; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tn.my"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|tn|02|my|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110774; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain colegiotorrevilano.es"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|colegiotorrevilano|02|es|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110775; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain olife.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|olife|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110776; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain scottlewisonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|scottlewisonline|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110777; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain digitalgroupe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|digitalgroupe|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110778; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sly.io"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|sly|02|io|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110779; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain taivas.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|taivas|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110780; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain wojb.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|wojb|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110781; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain shoppingexpress.com.au"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|shoppingexpress|03|com|02|au|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110782; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain rltk.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|rltk|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110783; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain notici.as"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|notici|02|as|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110784; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain shen.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|shen|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110785; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain solfa.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|solfa|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110786; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain agila.com.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|agila|03|com|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110787; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jesus.si"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|jesus|02|si|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110788; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nlpd.net.au"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|nlpd|03|net|02|au|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110789; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tagan-rog.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|tagan-rog|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110790; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain rcrcc.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|rcrcc|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110791; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vistnet.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|vistnet|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110792; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e-m-a-i-l.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|e-m-a-i-l|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110793; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain endlessmovie.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|endlessmovie|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110794; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain evilrouter.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|evilrouter|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110795; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain auraria.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|auraria|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110796; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ccmissoula.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|ccmissoula|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110797; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain blogs.or.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|blogs|02|or|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110798; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e.co.za"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|01|e|02|co|02|za|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110799; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain zhilcontrol.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|zhilcontrol|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110800; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ns22.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ns22|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110801; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain qlbv.vn"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|qlbv|02|vn|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110802; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain prostore.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|prostore|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110803; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain divakeramika.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|divakeramika|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110804; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sweetriders.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|sweetriders|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110805; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain make.com.ar"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|make|03|com|02|ar|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110806; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain smelly.cc"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|smelly|02|cc|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110807; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain b33r.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|b33r|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110808; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gerastar.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|gerastar|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110809; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tvlinux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|tvlinux|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110810; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain linux70.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|linux70|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110811; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dellsale.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|dellsale|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110812; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain lolk.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|lolk|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110813; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain priamaakcia.sk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|priamaakcia|02|sk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110814; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain aintno.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|aintno|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110815; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jcor.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|jcor|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110816; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kein.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|kein|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110817; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain procare.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|procare|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110818; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tv-l.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|tv-l|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110819; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain diipl.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|diipl|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110820; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain null.rs"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|null|02|rs|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110821; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain reason.org.nz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|reason|03|org|02|nz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110822; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain happyminecraft.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|happyminecraft|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110823; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain plnntt.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|plnntt|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110824; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain everton.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|everton|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110825; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gurcanozturk.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|gurcanozturk|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110826; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jpfiles.eu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|jpfiles|02|eu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110827; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain kiani.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|kiani|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110828; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain caturelang.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|caturelang|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110829; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain pckf.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|pckf|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110830; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain trumgame.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|trumgame|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110831; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain brawlcustommusic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|brawlcustommusic|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110832; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dnet.hu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dnet|02|hu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110833; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain innograph.co.id"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|innograph|02|co|02|id|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110834; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sith.su"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|sith|02|su|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110835; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain naru.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|naru|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110836; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 8634.su"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|8634|02|su|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110837; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ivi.pl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ivi|02|pl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110838; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain polissya.eu"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|polissya|02|eu|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110839; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hitremixes.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|hitremixes|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110840; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain m-kopa.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|m-kopa|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110841; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain netmask.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|netmask|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110842; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain warmkessel.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|warmkessel|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110843; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hayeshelp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|hayeshelp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110844; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain yourspecialtee.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|yourspecialtee|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110845; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain donkeyhot.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|donkeyhot|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110846; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 2ku.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|2ku|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110847; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gebish.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|gebish|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110848; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain russkoeumea.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|russkoeumea|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110849; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain haki.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|haki|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110850; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ilkor.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ilkor|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110851; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain mett.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|mett|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110852; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain orskkino.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|orskkino|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110853; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain swsc.org.np"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|swsc|03|org|02|np|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110854; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain 150watt.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|150watt|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110855; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain dp76.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dp76|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110856; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain gtk.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|gtk|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110857; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain privateimport.jp"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|privateimport|02|jp|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110858; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tedx.ee"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|tedx|02|ee|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110859; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tru.io"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|tru|02|io|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110860; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain cc.net.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|cc|03|net|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110861; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain lanas.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|lanas|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110862; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain ugo.si"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ugo|02|si|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110863; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain elitter.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|elitter|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110864; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain evs.net.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|evs|03|net|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110865; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jundy.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|jundy|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110866; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nevskayaratusha.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|nevskayaratusha|02|ru|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110867; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain technopagans.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|technopagans|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110868; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain asianfreshproduce.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|asianfreshproduce|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110869; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain hijaxdesigns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|hijaxdesigns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110870; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain morganisageek.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|morganisageek|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110871; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain radiogirl.fm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|radiogirl|02|fm|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110872; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e-education.hk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|e-education|02|hk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110873; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tn.my"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|tn|02|my|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110874; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain colegiotorrevilano.es"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|colegiotorrevilano|02|es|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110875; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain olife.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|olife|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110876; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain scottlewisonline.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|scottlewisonline|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110877; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain digitalgroupe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|digitalgroupe|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110878; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain sly.io"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|sly|02|io|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110879; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain taivas.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|taivas|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110880; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain wojb.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|wojb|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110881; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain shoppingexpress.com.au"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|shoppingexpress|03|com|02|au|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110882; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain rltk.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|rltk|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110883; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain notici.as"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|notici|02|as|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110884; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain shen.cl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|shen|02|cl|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110885; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain solfa.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|solfa|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110886; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain agila.com.br"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|agila|03|com|02|br|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110887; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain jesus.si"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|jesus|02|si|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110888; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain nlpd.net.au"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|nlpd|03|net|02|au|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110889; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain tagan-rog.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|tagan-rog|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110890; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain rcrcc.ca"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|rcrcc|02|ca|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110891; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain vistnet.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|vistnet|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110892; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain e-m-a-i-l.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|e-m-a-i-l|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110893; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain endlessmovie.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|endlessmovie|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110894; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain evilrouter.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|evilrouter|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110895; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query Afraid DNS domain auraria.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|auraria|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110896; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain darktech.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|darktech|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110897; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain effers.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|effers|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110898; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain 4irc.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|4irc|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110899; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain slyip.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|slyip|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110900; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain bbsindex.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|bbsindex|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110901; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain chatnook.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|chatnook|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110902; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain b0ne.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|b0ne|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110903; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain slyip.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|slyip|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110904; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain 3d-game.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|3d-game|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110905; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain suroot.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|suroot|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110906; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain etowns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|etowns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110907; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain dtdns.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dtdns|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110908; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain gotgeeks.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|gotgeeks|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110909; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain scieron.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|scieron|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110910; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain etowns.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|etowns|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110911; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain flnet.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|flnet|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110912; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query DTDNS domain deaftone.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|deaftone|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110913; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain zzux.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|zzux|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110914; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain onmypc.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|onmypc|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110915; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain lflinkup.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|lflinkup|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110916; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dynamicdns.me.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dynamicdns|02|me|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110917; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ourhobby.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|ourhobby|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110918; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain onmypc.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|onmypc|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110919; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain itsaol.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|itsaol|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110920; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain instanthq.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|instanthq|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110921; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ns2.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|ns2|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110922; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain wikaba.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|wikaba|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110923; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ns02.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ns02|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110924; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain https443.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|https443|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110925; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain 1dumb.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|1dumb|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110926; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain https443.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|https443|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110927; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain serveusers.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|serveusers|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110928; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain jkub.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|jkub|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110929; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain qpoe.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|qpoe|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110930; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain organiccrap.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|organiccrap|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110931; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ddns.mobi"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ddns|04|mobi|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110932; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dns04.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dns04|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110933; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dynamicdns.org.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dynamicdns|03|org|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110934; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain authorizeddns.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|authorizeddns|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110935; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ikwb.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ikwb|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110936; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain myftp.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|myftp|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110937; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mymom.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mymom|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110938; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain squirly.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|squirly|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110939; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mrbasic.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|mrbasic|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110940; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain serveuser.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|serveuser|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110941; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain epac.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|epac|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110942; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dns-dns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|dns-dns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110943; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ns02.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ns02|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110944; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ocry.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ocry|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110945; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain authorizeddns.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|authorizeddns|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110946; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ninth.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|ninth|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110947; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dynamicdns.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dynamicdns|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110948; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain changeip.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|changeip|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110949; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dyndns.pro"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|dyndns|03|pro|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110950; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain pcanywhere.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|pcanywhere|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110951; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain 25u.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|25u|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110952; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mydad.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|mydad|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110953; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain cleansite.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|cleansite|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110954; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain freetcp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|freetcp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110955; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain rebatesrule.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|rebatesrule|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110956; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain zyns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|zyns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110957; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain toythieves.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|toythieves|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110958; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain myddns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|myddns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110959; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain got-game.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|got-game|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110960; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain onmypc.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|onmypc|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110961; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain vizvaz.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|vizvaz|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110962; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain gr8domain.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|gr8domain|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110963; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dns05.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dns05|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110964; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain lflinkup.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|lflinkup|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110965; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dns-stuff.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|dns-stuff|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110966; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mynumber.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|mynumber|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110967; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ddns.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ddns|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110968; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dsmtp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dsmtp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110969; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mynetav.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|mynetav|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110970; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain proxydns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|proxydns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110971; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mrface.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mrface|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110972; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain jungleheart.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0b|jungleheart|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110973; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mypop3.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|mypop3|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110974; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ftp1.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|ftp1|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110975; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain 4pu.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|4pu|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110976; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain myz.info"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|myz|04|info|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110977; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain 4mydomain.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|4mydomain|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110978; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mynetav.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|mynetav|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110979; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mrbonus.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|mrbonus|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110980; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain trickip.org"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|trickip|03|org|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110981; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain trickip.net"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|trickip|03|net|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110982; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dns1.us"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dns1|02|us|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110983; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mysecondarydns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|mysecondarydns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110984; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain xxxy.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|xxxy|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110985; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain ftpserver.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|09|ftpserver|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110986; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dhcp.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|dhcp|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110987; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dnset.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|05|dnset|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110988; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain freeddns.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|freeddns|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110989; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain sendsmtp.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|sendsmtp|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110990; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain mefound.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|mefound|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110991; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain port25.biz"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|06|port25|03|biz|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110992; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain americanunfinished.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|americanunfinished|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110993; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain 4dq.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|4dq|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110994; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain dynamicdns.co.uk"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|dynamicdns|02|co|02|uk|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110995; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain faqserv.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|faqserv|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110996; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain changeip.name"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|changeip|04|name|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110997; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain yourtrap.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|yourtrap|03|com|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110998; rev:1;)
alert udp $HOME_NET any -> any 53 (msg:"ET INFO DYNAMIC_DNS Query ChangeIP.com domain compress.to"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|compress|02|to|00|"; nocase; fast_pattern:only; classtype:misc-activity; sid:10110999; rev:1;)