dyndns-tls.rules

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain flashserv.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".flashserv.net"; fast_pattern; distance:-14; within:14; sid:10120000; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain flashserv.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".flashserv.net"; fast_pattern; distance:-14; within:14; sid:10120001; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain xns01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xns01.com"; fast_pattern; distance:-10; within:10; sid:10120002; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain xns01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xns01.com"; fast_pattern; distance:-10; within:10; sid:10120003; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsdynamic.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdynamic.net"; fast_pattern; distance:-15; within:15; sid:10120004; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsdynamic.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdynamic.net"; fast_pattern; distance:-15; within:15; sid:10120005; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsget.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsget.org"; fast_pattern; distance:-11; within:11; sid:10120006; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsget.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsget.org"; fast_pattern; distance:-11; within:11; sid:10120007; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain proxy8080.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".proxy8080.com"; fast_pattern; distance:-14; within:14; sid:10120008; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain proxy8080.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".proxy8080.com"; fast_pattern; distance:-14; within:14; sid:10120009; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain mysq1.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysq1.net"; fast_pattern; distance:-10; within:10; sid:10120010; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain mysq1.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysq1.net"; fast_pattern; distance:-10; within:10; sid:10120011; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".http01.com"; fast_pattern; distance:-11; within:11; sid:10120012; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".http01.com"; fast_pattern; distance:-11; within:11; sid:10120013; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ssh01.com"; fast_pattern; distance:-10; within:10; sid:10120014; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ssh01.com"; fast_pattern; distance:-10; within:10; sid:10120015; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain user32.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".user32.com"; fast_pattern; distance:-11; within:11; sid:10120016; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain user32.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".user32.com"; fast_pattern; distance:-11; within:11; sid:10120017; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ttl60.com"; fast_pattern; distance:-10; within:10; sid:10120018; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ttl60.com"; fast_pattern; distance:-10; within:10; sid:10120019; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ddns01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns01.com"; fast_pattern; distance:-11; within:11; sid:10120020; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ddns01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns01.com"; fast_pattern; distance:-11; within:11; sid:10120021; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain fe100.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fe100.net"; fast_pattern; distance:-10; within:10; sid:10120022; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain fe100.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fe100.net"; fast_pattern; distance:-10; within:10; sid:10120023; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain imap01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".imap01.com"; fast_pattern; distance:-11; within:11; sid:10120024; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain imap01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".imap01.com"; fast_pattern; distance:-11; within:11; sid:10120025; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain craftx.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".craftx.biz"; fast_pattern; distance:-11; within:11; sid:10120026; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain craftx.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".craftx.biz"; fast_pattern; distance:-11; within:11; sid:10120027; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ns360.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns360.info"; fast_pattern; distance:-11; within:11; sid:10120028; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ns360.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns360.info"; fast_pattern; distance:-11; within:11; sid:10120029; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ttl60.org"; fast_pattern; distance:-10; within:10; sid:10120030; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ttl60.org"; fast_pattern; distance:-10; within:10; sid:10120031; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain x64.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".x64.me"; fast_pattern; distance:-7; within:7; sid:10120032; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain x64.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".x64.me"; fast_pattern; distance:-7; within:7; sid:10120033; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tempors.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tempors.com"; fast_pattern; distance:-12; within:12; sid:10120034; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tempors.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tempors.com"; fast_pattern; distance:-12; within:12; sid:10120035; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain https443.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".https443.com"; fast_pattern; distance:-13; within:13; sid:10120036; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain https443.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".https443.com"; fast_pattern; distance:-13; within:13; sid:10120037; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tftpd.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tftpd.net"; fast_pattern; distance:-10; within:10; sid:10120038; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tftpd.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tftpd.net"; fast_pattern; distance:-10; within:10; sid:10120039; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain wow64.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wow64.net"; fast_pattern; distance:-10; within:10; sid:10120040; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain wow64.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wow64.net"; fast_pattern; distance:-10; within:10; sid:10120041; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsapi.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsapi.info"; fast_pattern; distance:-12; within:12; sid:10120042; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsapi.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsapi.info"; fast_pattern; distance:-12; within:12; sid:10120043; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain kadm5.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kadm5.com"; fast_pattern; distance:-10; within:10; sid:10120044; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain kadm5.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kadm5.com"; fast_pattern; distance:-10; within:10; sid:10120045; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain voip01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".voip01.com"; fast_pattern; distance:-11; within:11; sid:10120046; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain voip01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".voip01.com"; fast_pattern; distance:-11; within:11; sid:10120047; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh22.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ssh22.net"; fast_pattern; distance:-10; within:10; sid:10120048; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh22.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ssh22.net"; fast_pattern; distance:-10; within:10; sid:10120049; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ftp21.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftp21.net"; fast_pattern; distance:-10; within:10; sid:10120050; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ftp21.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftp21.net"; fast_pattern; distance:-10; within:10; sid:10120051; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ntdll.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ntdll.net"; fast_pattern; distance:-10; within:10; sid:10120052; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ntdll.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ntdll.net"; fast_pattern; distance:-10; within:10; sid:10120053; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dns53.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns53.biz"; fast_pattern; distance:-10; within:10; sid:10120054; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dns53.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns53.biz"; fast_pattern; distance:-10; within:10; sid:10120055; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsd.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsd.info"; fast_pattern; distance:-10; within:10; sid:10120056; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsd.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsd.info"; fast_pattern; distance:-10; within:10; sid:10120057; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain sql01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sql01.com"; fast_pattern; distance:-10; within:10; sid:10120058; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain sql01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sql01.com"; fast_pattern; distance:-10; within:10; sid:10120059; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ole32.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ole32.com"; fast_pattern; distance:-10; within:10; sid:10120060; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ole32.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ole32.com"; fast_pattern; distance:-10; within:10; sid:10120061; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain adultdns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".adultdns.net"; fast_pattern; distance:-13; within:13; sid:10120062; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain adultdns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".adultdns.net"; fast_pattern; distance:-13; within:13; sid:10120063; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http80.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".http80.info"; fast_pattern; distance:-12; within:12; sid:10120064; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http80.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".http80.info"; fast_pattern; distance:-12; within:12; sid:10120065; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain blogsyte.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogsyte.com"; distance:-13; within:13; sid:10120066; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain blogsyte.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogsyte.com"; fast_pattern; distance:-13; within:13; sid:10120067; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain brasilia.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".brasilia.me"; distance:-12; within:12; sid:10120068; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain brasilia.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".brasilia.me"; fast_pattern; distance:-12; within:12; sid:10120069; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain cable-modem.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cable-modem.org"; distance:-16; within:16; sid:10120070; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain cable-modem.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cable-modem.org"; fast_pattern; distance:-16; within:16; sid:10120071; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ciscofreak.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ciscofreak.com"; distance:-15; within:15; sid:10120072; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ciscofreak.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ciscofreak.com"; fast_pattern; distance:-15; within:15; sid:10120073; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain collegefan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".collegefan.org"; distance:-15; within:15; sid:10120074; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain collegefan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".collegefan.org"; fast_pattern; distance:-15; within:15; sid:10120075; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain couchpotatofries.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".couchpotatofries.org"; distance:-21; within:21; sid:10120076; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain couchpotatofries.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".couchpotatofries.org"; fast_pattern; distance:-21; within:21; sid:10120077; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain damnserver.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".damnserver.com"; distance:-15; within:15; sid:10120078; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain damnserver.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".damnserver.com"; fast_pattern; distance:-15; within:15; sid:10120079; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.me"; distance:-8; within:8; sid:10120080; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.me"; fast_pattern; distance:-8; within:8; sid:10120081; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ditchyourip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ditchyourip.com"; distance:-16; within:16; sid:10120082; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ditchyourip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ditchyourip.com"; fast_pattern; distance:-16; within:16; sid:10120083; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsfor.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsfor.me"; distance:-10; within:10; sid:10120084; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsfor.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsfor.me"; fast_pattern; distance:-10; within:10; sid:10120085; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsiskinky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsiskinky.com"; distance:-15; within:15; sid:10120086; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsiskinky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsiskinky.com"; fast_pattern; distance:-15; within:15; sid:10120087; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dvrcam.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dvrcam.info"; distance:-12; within:12; sid:10120088; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dvrcam.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dvrcam.info"; fast_pattern; distance:-12; within:12; sid:10120089; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dynns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynns.com"; distance:-10; within:10; sid:10120090; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dynns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynns.com"; fast_pattern; distance:-10; within:10; sid:10120091; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain eating-organic.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".eating-organic.net"; distance:-19; within:19; sid:10120092; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain eating-organic.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".eating-organic.net"; fast_pattern; distance:-19; within:19; sid:10120093; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain fantasyleague.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fantasyleague.cc"; distance:-17; within:17; sid:10120094; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain fantasyleague.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fantasyleague.cc"; fast_pattern; distance:-17; within:17; sid:10120095; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain geekgalaxy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".geekgalaxy.com"; distance:-15; within:15; sid:10120096; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain geekgalaxy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".geekgalaxy.com"; fast_pattern; distance:-15; within:15; sid:10120097; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain golffan.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".golffan.us"; distance:-11; within:11; sid:10120098; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain golffan.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".golffan.us"; fast_pattern; distance:-11; within:11; sid:10120099; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain health-carereform.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".health-carereform.com"; distance:-22; within:22; sid:10120100; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain health-carereform.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".health-carereform.com"; fast_pattern; distance:-22; within:22; sid:10120101; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritymac.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homesecuritymac.com"; distance:-20; within:20; sid:10120102; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritymac.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homesecuritymac.com"; fast_pattern; distance:-20; within:20; sid:10120103; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritypc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homesecuritypc.com"; distance:-19; within:19; sid:10120104; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritypc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homesecuritypc.com"; fast_pattern; distance:-19; within:19; sid:10120105; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hopto.me"; distance:-9; within:9; sid:10120106; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hopto.me"; fast_pattern; distance:-9; within:9; sid:10120107; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ilovecollege.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ilovecollege.info"; distance:-18; within:18; sid:10120108; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ilovecollege.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ilovecollege.info"; fast_pattern; distance:-18; within:18; sid:10120109; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain loginto.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".loginto.me"; distance:-11; within:11; sid:10120110; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain loginto.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".loginto.me"; fast_pattern; distance:-11; within:11; sid:10120111; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mlbfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mlbfan.org"; distance:-11; within:11; sid:10120112; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mlbfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mlbfan.org"; fast_pattern; distance:-11; within:11; sid:10120113; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mmafan.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mmafan.biz"; distance:-11; within:11; sid:10120114; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mmafan.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mmafan.biz"; fast_pattern; distance:-11; within:11; sid:10120115; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myactivedirectory.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myactivedirectory.com"; distance:-22; within:22; sid:10120116; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myactivedirectory.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myactivedirectory.com"; fast_pattern; distance:-22; within:22; sid:10120117; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mydissent.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mydissent.net"; distance:-14; within:14; sid:10120118; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mydissent.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mydissent.net"; fast_pattern; distance:-14; within:14; sid:10120119; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myeffect.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myeffect.net"; distance:-13; within:13; sid:10120120; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myeffect.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myeffect.net"; fast_pattern; distance:-13; within:13; sid:10120121; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mymediapc.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mymediapc.net"; distance:-14; within:14; sid:10120122; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mymediapc.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mymediapc.net"; fast_pattern; distance:-14; within:14; sid:10120123; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mypsx.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypsx.net"; distance:-10; within:10; sid:10120124; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mypsx.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypsx.net"; fast_pattern; distance:-10; within:10; sid:10120125; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecuritycamera.com"; distance:-21; within:21; sid:10120126; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecuritycamera.com"; fast_pattern; distance:-21; within:21; sid:10120127; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecuritycamera.net"; distance:-21; within:21; sid:10120128; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecuritycamera.net"; fast_pattern; distance:-21; within:21; sid:10120129; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecuritycamera.org"; distance:-21; within:21; sid:10120130; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecuritycamera.org"; fast_pattern; distance:-21; within:21; sid:10120131; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain net-freaks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".net-freaks.com"; distance:-15; within:15; sid:10120132; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain net-freaks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".net-freaks.com"; fast_pattern; distance:-15; within:15; sid:10120133; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nflfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nflfan.org"; distance:-11; within:11; sid:10120134; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nflfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nflfan.org"; fast_pattern; distance:-11; within:11; sid:10120135; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nhlfan.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nhlfan.net"; distance:-11; within:11; sid:10120136; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nhlfan.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nhlfan.net"; fast_pattern; distance:-11; within:11; sid:10120137; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.ca"; distance:-9; within:9; sid:10120138; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.ca"; fast_pattern; distance:-9; within:9; sid:10120139; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.co.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.co.uk"; distance:-12; within:12; sid:10120140; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.co.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.co.uk"; fast_pattern; distance:-12; within:12; sid:10120141; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.net"; distance:-10; within:10; sid:10120142; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.net"; fast_pattern; distance:-10; within:10; sid:10120143; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".noip.us"; distance:-8; within:8; sid:10120144; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".noip.us"; fast_pattern; distance:-8; within:8; sid:10120145; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pgafan.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pgafan.net"; distance:-11; within:11; sid:10120146; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pgafan.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pgafan.net"; fast_pattern; distance:-11; within:11; sid:10120147; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain point2this.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".point2this.com"; distance:-15; within:15; sid:10120148; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain point2this.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".point2this.com"; fast_pattern; distance:-15; within:15; sid:10120149; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pointto.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pointto.us"; distance:-11; within:11; sid:10120150; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pointto.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pointto.us"; fast_pattern; distance:-11; within:11; sid:10120151; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain privatizehealthinsurance.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".privatizehealthinsurance.net"; distance:-29; within:29; sid:10120152; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain privatizehealthinsurance.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".privatizehealthinsurance.net"; fast_pattern; distance:-29; within:29; sid:10120153; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain quicksytes.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".quicksytes.com"; distance:-15; within:15; sid:10120154; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain quicksytes.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".quicksytes.com"; fast_pattern; distance:-15; within:15; sid:10120155; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain read-books.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".read-books.org"; distance:-15; within:15; sid:10120156; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain read-books.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".read-books.org"; fast_pattern; distance:-15; within:15; sid:10120157; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securityexploits.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".securityexploits.com"; distance:-21; within:21; sid:10120158; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securityexploits.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".securityexploits.com"; fast_pattern; distance:-21; within:21; sid:10120159; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securitytactics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".securitytactics.com"; distance:-20; within:20; sid:10120160; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securitytactics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".securitytactics.com"; fast_pattern; distance:-20; within:20; sid:10120161; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveexchange.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveexchange.com"; distance:-18; within:18; sid:10120162; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveexchange.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveexchange.com"; fast_pattern; distance:-18; within:18; sid:10120163; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehumour.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servehumour.com"; distance:-16; within:16; sid:10120164; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehumour.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servehumour.com"; fast_pattern; distance:-16; within:16; sid:10120165; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servep2p.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servep2p.com"; distance:-13; within:13; sid:10120166; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servep2p.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servep2p.com"; fast_pattern; distance:-13; within:13; sid:10120167; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servesarcasm.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servesarcasm.com"; distance:-17; within:17; sid:10120168; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servesarcasm.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servesarcasm.com"; fast_pattern; distance:-17; within:17; sid:10120169; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain stufftoread.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stufftoread.com"; distance:-16; within:16; sid:10120170; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain stufftoread.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stufftoread.com"; fast_pattern; distance:-16; within:16; sid:10120171; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ufcfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ufcfan.org"; distance:-11; within:11; sid:10120172; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ufcfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ufcfan.org"; fast_pattern; distance:-11; within:11; sid:10120173; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain unusualperson.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".unusualperson.com"; distance:-18; within:18; sid:10120174; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain unusualperson.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".unusualperson.com"; fast_pattern; distance:-18; within:18; sid:10120175; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain workisboring.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".workisboring.com"; distance:-17; within:17; sid:10120176; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain workisboring.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".workisboring.com"; fast_pattern; distance:-17; within:17; sid:10120177; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain 3utilities.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3utilities.com"; distance:-15; within:15; sid:10120178; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain 3utilities.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3utilities.com"; fast_pattern; distance:-15; within:15; sid:10120179; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain bounceme.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bounceme.net"; distance:-13; within:13; sid:10120180; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain bounceme.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bounceme.net"; fast_pattern; distance:-13; within:13; sid:10120181; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.net"; distance:-9; within:9; sid:10120182; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.net"; fast_pattern; distance:-9; within:9; sid:10120183; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddnsking.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddnsking.com"; distance:-13; within:13; sid:10120184; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddnsking.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddnsking.com"; fast_pattern; distance:-13; within:13; sid:10120185; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain gotdns.ch"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotdns.ch"; distance:-10; within:10; sid:10120186; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain gotdns.ch in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotdns.ch"; fast_pattern; distance:-10; within:10; sid:10120187; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hopto.org"; distance:-10; within:10; sid:10120188; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hopto.org"; fast_pattern; distance:-10; within:10; sid:10120189; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myftp.biz"; distance:-10; within:10; sid:10120190; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myftp.biz"; fast_pattern; distance:-10; within:10; sid:10120191; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myftp.org"; distance:-10; within:10; sid:10120192; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myftp.org"; fast_pattern; distance:-10; within:10; sid:10120193; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myvnc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myvnc.com"; distance:-10; within:10; sid:10120194; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myvnc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myvnc.com"; fast_pattern; distance:-10; within:10; sid:10120195; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.biz"; distance:-10; within:10; sid:10120196; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.biz"; fast_pattern; distance:-10; within:10; sid:10120197; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.info"; distance:-11; within:11; sid:10120198; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.info"; fast_pattern; distance:-11; within:11; sid:10120199; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.org"; distance:-10; within:10; sid:10120200; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.org"; fast_pattern; distance:-10; within:10; sid:10120201; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".noip.me"; distance:-8; within:8; sid:10120202; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".noip.me"; fast_pattern; distance:-8; within:8; sid:10120203; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain redirectme.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".redirectme.net"; distance:-15; within:15; sid:10120204; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain redirectme.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".redirectme.net"; fast_pattern; distance:-15; within:15; sid:10120205; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servebeer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebeer.com"; distance:-14; within:14; sid:10120206; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servebeer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebeer.com"; fast_pattern; distance:-14; within:14; sid:10120207; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveblog.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveblog.net"; distance:-14; within:14; sid:10120208; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveblog.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveblog.net"; fast_pattern; distance:-14; within:14; sid:10120209; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servecounterstrike.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servecounterstrike.com"; distance:-23; within:23; sid:10120210; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servecounterstrike.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servecounterstrike.com"; fast_pattern; distance:-23; within:23; sid:10120211; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveftp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveftp.com"; distance:-13; within:13; sid:10120212; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveftp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveftp.com"; fast_pattern; distance:-13; within:13; sid:10120213; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servegame.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servegame.com"; distance:-14; within:14; sid:10120214; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servegame.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servegame.com"; fast_pattern; distance:-14; within:14; sid:10120215; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehalflife.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servehalflife.com"; distance:-18; within:18; sid:10120216; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehalflife.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servehalflife.com"; fast_pattern; distance:-18; within:18; sid:10120217; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehttp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servehttp.com"; distance:-14; within:14; sid:10120218; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehttp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servehttp.com"; fast_pattern; distance:-14; within:14; sid:10120219; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveminecraft.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveminecraft.net"; distance:-19; within:19; sid:10120220; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveminecraft.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveminecraft.net"; fast_pattern; distance:-19; within:19; sid:10120221; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servemp3.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servemp3.com"; distance:-13; within:13; sid:10120222; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servemp3.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servemp3.com"; fast_pattern; distance:-13; within:13; sid:10120223; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servepics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servepics.com"; distance:-14; within:14; sid:10120224; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servepics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servepics.com"; fast_pattern; distance:-14; within:14; sid:10120225; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servequake.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servequake.com"; distance:-15; within:15; sid:10120226; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servequake.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servequake.com"; fast_pattern; distance:-15; within:15; sid:10120227; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain sytes.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sytes.net"; distance:-10; within:10; sid:10120228; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain sytes.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sytes.net"; fast_pattern; distance:-10; within:10; sid:10120229; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain webhop.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.me"; distance:-10; within:10; sid:10120230; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain webhop.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.me"; fast_pattern; distance:-10; within:10; sid:10120231; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain zapto.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zapto.org"; distance:-10; within:10; sid:10120232; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain zapto.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zapto.org"; fast_pattern; distance:-10; within:10; sid:10120233; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain at-band-camp.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".at-band-camp.net"; fast_pattern; distance:-17; within:17; sid:10120234; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain at-band-camp.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".at-band-camp.net"; fast_pattern; distance:-17; within:17; sid:10120235; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrel-of-knowledge.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".barrel-of-knowledge.info"; fast_pattern; distance:-25; within:25; sid:10120236; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrel-of-knowledge.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".barrel-of-knowledge.info"; fast_pattern; distance:-25; within:25; sid:10120237; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrell-of-knowledge.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".barrell-of-knowledge.info"; fast_pattern; distance:-26; within:26; sid:10120238; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrell-of-knowledge.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".barrell-of-knowledge.info"; fast_pattern; distance:-26; within:26; sid:10120239; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain better-than.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".better-than.tv"; fast_pattern; distance:-15; within:15; sid:10120240; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain better-than.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".better-than.tv"; fast_pattern; distance:-15; within:15; sid:10120241; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogdns.com"; fast_pattern; distance:-12; within:12; sid:10120242; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogdns.com"; fast_pattern; distance:-12; within:12; sid:10120243; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogdns.net"; fast_pattern; distance:-12; within:12; sid:10120244; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogdns.net"; fast_pattern; distance:-12; within:12; sid:10120245; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogdns.org"; fast_pattern; distance:-12; within:12; sid:10120246; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogdns.org"; fast_pattern; distance:-12; within:12; sid:10120247; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogsite.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogsite.org"; fast_pattern; distance:-13; within:13; sid:10120248; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogsite.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogsite.org"; fast_pattern; distance:-13; within:13; sid:10120249; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain boldlygoingnowhere.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".boldlygoingnowhere.org"; fast_pattern; distance:-23; within:23; sid:10120250; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain boldlygoingnowhere.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".boldlygoingnowhere.org"; fast_pattern; distance:-23; within:23; sid:10120251; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain broke-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".broke-it.net"; fast_pattern; distance:-13; within:13; sid:10120252; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain broke-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".broke-it.net"; fast_pattern; distance:-13; within:13; sid:10120253; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain buyshouses.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".buyshouses.net"; fast_pattern; distance:-15; within:15; sid:10120254; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain buyshouses.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".buyshouses.net"; fast_pattern; distance:-15; within:15; sid:10120255; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain cechire.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cechire.com"; fast_pattern; distance:-12; within:12; sid:10120256; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain cechire.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cechire.com"; fast_pattern; distance:-12; within:12; sid:10120257; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.com"; fast_pattern; distance:-13; within:13; sid:10120258; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.com"; fast_pattern; distance:-13; within:13; sid:10120259; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.net"; fast_pattern; distance:-13; within:13; sid:10120260; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.net"; fast_pattern; distance:-13; within:13; sid:10120261; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.org"; fast_pattern; distance:-13; within:13; sid:10120262; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.org"; fast_pattern; distance:-13; within:13; sid:10120263; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdojo.com"; fast_pattern; distance:-12; within:12; sid:10120264; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdojo.com"; fast_pattern; distance:-12; within:12; sid:10120265; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdojo.net"; fast_pattern; distance:-12; within:12; sid:10120266; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdojo.net"; fast_pattern; distance:-12; within:12; sid:10120267; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdojo.org"; fast_pattern; distance:-12; within:12; sid:10120268; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdojo.org"; fast_pattern; distance:-12; within:12; sid:10120269; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain does-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".does-it.net"; fast_pattern; distance:-12; within:12; sid:10120270; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain does-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".does-it.net"; fast_pattern; distance:-12; within:12; sid:10120271; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doesntexist.com"; fast_pattern; distance:-16; within:16; sid:10120272; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doesntexist.com"; fast_pattern; distance:-16; within:16; sid:10120273; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doesntexist.org"; fast_pattern; distance:-16; within:16; sid:10120274; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doesntexist.org"; fast_pattern; distance:-16; within:16; sid:10120275; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dontexist.com"; fast_pattern; distance:-14; within:14; sid:10120276; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dontexist.com"; fast_pattern; distance:-14; within:14; sid:10120277; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dontexist.net"; fast_pattern; distance:-14; within:14; sid:10120278; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dontexist.net"; fast_pattern; distance:-14; within:14; sid:10120279; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dontexist.org"; fast_pattern; distance:-14; within:14; sid:10120280; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dontexist.org"; fast_pattern; distance:-14; within:14; sid:10120281; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doomdns.com"; fast_pattern; distance:-12; within:12; sid:10120282; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doomdns.com"; fast_pattern; distance:-12; within:12; sid:10120283; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doomdns.org"; fast_pattern; distance:-12; within:12; sid:10120284; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doomdns.org"; fast_pattern; distance:-12; within:12; sid:10120285; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dvrdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dvrdns.org"; fast_pattern; distance:-11; within:11; sid:10120286; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dvrdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dvrdns.org"; fast_pattern; distance:-11; within:11; sid:10120287; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyn-o-saur.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyn-o-saur.com"; fast_pattern; distance:-15; within:15; sid:10120288; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyn-o-saur.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyn-o-saur.com"; fast_pattern; distance:-15; within:15; sid:10120289; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynalias.com"; fast_pattern; distance:-13; within:13; sid:10120290; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynalias.com"; fast_pattern; distance:-13; within:13; sid:10120291; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynalias.net"; fast_pattern; distance:-13; within:13; sid:10120292; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynalias.net"; fast_pattern; distance:-13; within:13; sid:10120293; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynalias.org"; fast_pattern; distance:-13; within:13; sid:10120294; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynalias.org"; fast_pattern; distance:-13; within:13; sid:10120295; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynathome.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynathome.net"; fast_pattern; distance:-14; within:14; sid:10120296; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynathome.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynathome.net"; fast_pattern; distance:-14; within:14; sid:10120297; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-home.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-at-home.com"; fast_pattern; distance:-19; within:19; sid:10120298; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-home.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-at-home.com"; fast_pattern; distance:-19; within:19; sid:10120299; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-work.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-at-work.com"; fast_pattern; distance:-19; within:19; sid:10120300; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-work.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-at-work.com"; fast_pattern; distance:-19; within:19; sid:10120301; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-blog.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-blog.com"; fast_pattern; distance:-16; within:16; sid:10120302; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-blog.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-blog.com"; fast_pattern; distance:-16; within:16; sid:10120303; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-free.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-free.com"; fast_pattern; distance:-16; within:16; sid:10120304; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-free.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-free.com"; fast_pattern; distance:-16; within:16; sid:10120305; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-home.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-home.com"; fast_pattern; distance:-16; within:16; sid:10120306; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-home.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-home.com"; fast_pattern; distance:-16; within:16; sid:10120307; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-ip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-ip.com"; fast_pattern; distance:-14; within:14; sid:10120308; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-ip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-ip.com"; fast_pattern; distance:-14; within:14; sid:10120309; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-mail.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-mail.com"; fast_pattern; distance:-16; within:16; sid:10120310; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-mail.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-mail.com"; fast_pattern; distance:-16; within:16; sid:10120311; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-office.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-office.com"; fast_pattern; distance:-18; within:18; sid:10120312; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-office.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-office.com"; fast_pattern; distance:-18; within:18; sid:10120313; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-pics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-pics.com"; fast_pattern; distance:-16; within:16; sid:10120314; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-pics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-pics.com"; fast_pattern; distance:-16; within:16; sid:10120315; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-remote.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-remote.com"; fast_pattern; distance:-18; within:18; sid:10120316; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-remote.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-remote.com"; fast_pattern; distance:-18; within:18; sid:10120317; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-server.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-server.com"; fast_pattern; distance:-18; within:18; sid:10120318; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-server.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-server.com"; fast_pattern; distance:-18; within:18; sid:10120319; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-web.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-web.com"; fast_pattern; distance:-15; within:15; sid:10120320; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-web.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-web.com"; fast_pattern; distance:-15; within:15; sid:10120321; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-wiki.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-wiki.com"; fast_pattern; distance:-16; within:16; sid:10120322; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-wiki.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-wiki.com"; fast_pattern; distance:-16; within:16; sid:10120323; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-work.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-work.com"; fast_pattern; distance:-16; within:16; sid:10120324; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-work.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-work.com"; fast_pattern; distance:-16; within:16; sid:10120325; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.biz"; fast_pattern; distance:-11; within:11; sid:10120326; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.biz"; fast_pattern; distance:-11; within:11; sid:10120327; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.info"; fast_pattern; distance:-12; within:12; sid:10120328; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.info"; fast_pattern; distance:-12; within:12; sid:10120329; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.org"; fast_pattern; distance:-11; within:11; sid:10120330; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.org"; fast_pattern; distance:-11; within:11; sid:10120331; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.tv"; fast_pattern; distance:-10; within:10; sid:10120332; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.tv"; fast_pattern; distance:-10; within:10; sid:10120333; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.ws"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.ws"; fast_pattern; distance:-10; within:10; sid:10120334; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.ws in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.ws"; fast_pattern; distance:-10; within:10; sid:10120335; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endofinternet.net"; fast_pattern; distance:-18; within:18; sid:10120336; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endofinternet.net"; fast_pattern; distance:-18; within:18; sid:10120337; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endofinternet.org"; fast_pattern; distance:-18; within:18; sid:10120338; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endofinternet.org"; fast_pattern; distance:-18; within:18; sid:10120339; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endoftheinternet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endoftheinternet.org"; fast_pattern; distance:-21; within:21; sid:10120340; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endoftheinternet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endoftheinternet.org"; fast_pattern; distance:-21; within:21; sid:10120341; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-maison.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-a-la-maison.com"; fast_pattern; distance:-20; within:20; sid:10120342; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-maison.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-a-la-maison.com"; fast_pattern; distance:-20; within:20; sid:10120343; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-masion.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-a-la-masion.com"; fast_pattern; distance:-20; within:20; sid:10120344; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-masion.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-a-la-masion.com"; fast_pattern; distance:-20; within:20; sid:10120345; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-le-patron.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-le-patron.com"; fast_pattern; distance:-18; within:18; sid:10120346; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-le-patron.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-le-patron.com"; fast_pattern; distance:-18; within:18; sid:10120347; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-mon-blogueur.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-mon-blogueur.com"; fast_pattern; distance:-21; within:21; sid:10120348; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-mon-blogueur.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-mon-blogueur.com"; fast_pattern; distance:-21; within:21; sid:10120349; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-better.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-better.biz"; fast_pattern; distance:-15; within:15; sid:10120350; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-better.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-better.biz"; fast_pattern; distance:-15; within:15; sid:10120351; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-more.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-more.biz"; fast_pattern; distance:-13; within:13; sid:10120352; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-more.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-more.biz"; fast_pattern; distance:-13; within:13; sid:10120353; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-our.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-our.info"; fast_pattern; distance:-13; within:13; sid:10120354; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-our.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-our.info"; fast_pattern; distance:-13; within:13; sid:10120355; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-some.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-some.biz"; fast_pattern; distance:-13; within:13; sid:10120356; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-some.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-some.biz"; fast_pattern; distance:-13; within:13; sid:10120357; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-the.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-the.biz"; fast_pattern; distance:-12; within:12; sid:10120358; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-the.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-the.biz"; fast_pattern; distance:-12; within:12; sid:10120359; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.her.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".forgot.her.name"; fast_pattern; distance:-16; within:16; sid:10120360; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.her.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".forgot.her.name"; fast_pattern; distance:-16; within:16; sid:10120361; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.his.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".forgot.his.name"; fast_pattern; distance:-16; within:16; sid:10120362; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.his.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".forgot.his.name"; fast_pattern; distance:-16; within:16; sid:10120363; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ak.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ak.com"; fast_pattern; distance:-12; within:12; sid:10120364; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ak.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ak.com"; fast_pattern; distance:-12; within:12; sid:10120365; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-al.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-al.com"; fast_pattern; distance:-12; within:12; sid:10120366; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-al.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-al.com"; fast_pattern; distance:-12; within:12; sid:10120367; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ar.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ar.com"; fast_pattern; distance:-12; within:12; sid:10120368; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ar.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ar.com"; fast_pattern; distance:-12; within:12; sid:10120369; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-az.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-az.net"; fast_pattern; distance:-12; within:12; sid:10120370; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-az.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-az.net"; fast_pattern; distance:-12; within:12; sid:10120371; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ca.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ca.com"; fast_pattern; distance:-12; within:12; sid:10120372; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ca.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ca.com"; fast_pattern; distance:-12; within:12; sid:10120373; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-co.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-co.net"; fast_pattern; distance:-12; within:12; sid:10120374; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-co.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-co.net"; fast_pattern; distance:-12; within:12; sid:10120375; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ct.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ct.com"; fast_pattern; distance:-12; within:12; sid:10120376; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ct.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ct.com"; fast_pattern; distance:-12; within:12; sid:10120377; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-dc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-dc.com"; fast_pattern; distance:-12; within:12; sid:10120378; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-dc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-dc.com"; fast_pattern; distance:-12; within:12; sid:10120379; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-de.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-de.com"; fast_pattern; distance:-12; within:12; sid:10120380; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-de.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-de.com"; fast_pattern; distance:-12; within:12; sid:10120381; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-fl.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-fl.com"; fast_pattern; distance:-12; within:12; sid:10120382; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-fl.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-fl.com"; fast_pattern; distance:-12; within:12; sid:10120383; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ga.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ga.com"; fast_pattern; distance:-12; within:12; sid:10120384; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ga.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ga.com"; fast_pattern; distance:-12; within:12; sid:10120385; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-hi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-hi.com"; fast_pattern; distance:-12; within:12; sid:10120386; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-hi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-hi.com"; fast_pattern; distance:-12; within:12; sid:10120387; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ia.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ia.com"; fast_pattern; distance:-12; within:12; sid:10120388; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ia.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ia.com"; fast_pattern; distance:-12; within:12; sid:10120389; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-id.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-id.com"; fast_pattern; distance:-12; within:12; sid:10120390; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-id.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-id.com"; fast_pattern; distance:-12; within:12; sid:10120391; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-il.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-il.com"; fast_pattern; distance:-12; within:12; sid:10120392; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-il.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-il.com"; fast_pattern; distance:-12; within:12; sid:10120393; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-in.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-in.com"; fast_pattern; distance:-12; within:12; sid:10120394; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-in.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-in.com"; fast_pattern; distance:-12; within:12; sid:10120395; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ks.com"; fast_pattern; distance:-12; within:12; sid:10120396; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ks.com"; fast_pattern; distance:-12; within:12; sid:10120397; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ky.com"; fast_pattern; distance:-12; within:12; sid:10120398; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ky.com"; fast_pattern; distance:-12; within:12; sid:10120399; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-la.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-la.net"; fast_pattern; distance:-12; within:12; sid:10120400; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-la.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-la.net"; fast_pattern; distance:-12; within:12; sid:10120401; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ma.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ma.com"; fast_pattern; distance:-12; within:12; sid:10120402; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ma.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ma.com"; fast_pattern; distance:-12; within:12; sid:10120403; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-md.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-md.com"; fast_pattern; distance:-12; within:12; sid:10120404; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-md.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-md.com"; fast_pattern; distance:-12; within:12; sid:10120405; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-me.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-me.org"; fast_pattern; distance:-12; within:12; sid:10120406; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-me.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-me.org"; fast_pattern; distance:-12; within:12; sid:10120407; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mi.com"; fast_pattern; distance:-12; within:12; sid:10120408; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mi.com"; fast_pattern; distance:-12; within:12; sid:10120409; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mn.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mn.com"; fast_pattern; distance:-12; within:12; sid:10120410; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mn.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mn.com"; fast_pattern; distance:-12; within:12; sid:10120411; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mo.com"; fast_pattern; distance:-12; within:12; sid:10120412; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mo.com"; fast_pattern; distance:-12; within:12; sid:10120413; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ms.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ms.com"; fast_pattern; distance:-12; within:12; sid:10120414; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ms.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ms.com"; fast_pattern; distance:-12; within:12; sid:10120415; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mt.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mt.com"; fast_pattern; distance:-12; within:12; sid:10120416; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mt.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mt.com"; fast_pattern; distance:-12; within:12; sid:10120417; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nc.com"; fast_pattern; distance:-12; within:12; sid:10120418; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nc.com"; fast_pattern; distance:-12; within:12; sid:10120419; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nd.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nd.com"; fast_pattern; distance:-12; within:12; sid:10120420; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nd.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nd.com"; fast_pattern; distance:-12; within:12; sid:10120421; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ne.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ne.com"; fast_pattern; distance:-12; within:12; sid:10120422; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ne.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ne.com"; fast_pattern; distance:-12; within:12; sid:10120423; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nh.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nh.com"; fast_pattern; distance:-12; within:12; sid:10120424; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nh.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nh.com"; fast_pattern; distance:-12; within:12; sid:10120425; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nj.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nj.com"; fast_pattern; distance:-12; within:12; sid:10120426; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nj.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nj.com"; fast_pattern; distance:-12; within:12; sid:10120427; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nm.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nm.com"; fast_pattern; distance:-12; within:12; sid:10120428; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nm.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nm.com"; fast_pattern; distance:-12; within:12; sid:10120429; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nv.com"; fast_pattern; distance:-12; within:12; sid:10120430; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nv.com"; fast_pattern; distance:-12; within:12; sid:10120431; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ny.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ny.net"; fast_pattern; distance:-12; within:12; sid:10120432; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ny.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ny.net"; fast_pattern; distance:-12; within:12; sid:10120433; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-oh.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-oh.com"; fast_pattern; distance:-12; within:12; sid:10120434; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-oh.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-oh.com"; fast_pattern; distance:-12; within:12; sid:10120435; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ok.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ok.com"; fast_pattern; distance:-12; within:12; sid:10120436; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ok.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ok.com"; fast_pattern; distance:-12; within:12; sid:10120437; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-or.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-or.com"; fast_pattern; distance:-12; within:12; sid:10120438; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-or.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-or.com"; fast_pattern; distance:-12; within:12; sid:10120439; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pa.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-pa.com"; fast_pattern; distance:-12; within:12; sid:10120440; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pa.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-pa.com"; fast_pattern; distance:-12; within:12; sid:10120441; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pr.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-pr.com"; fast_pattern; distance:-12; within:12; sid:10120442; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pr.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-pr.com"; fast_pattern; distance:-12; within:12; sid:10120443; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ri.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ri.com"; fast_pattern; distance:-12; within:12; sid:10120444; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ri.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ri.com"; fast_pattern; distance:-12; within:12; sid:10120445; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-sc.com"; fast_pattern; distance:-12; within:12; sid:10120446; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-sc.com"; fast_pattern; distance:-12; within:12; sid:10120447; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sd.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-sd.com"; fast_pattern; distance:-12; within:12; sid:10120448; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sd.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-sd.com"; fast_pattern; distance:-12; within:12; sid:10120449; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tn.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-tn.com"; fast_pattern; distance:-12; within:12; sid:10120450; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tn.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-tn.com"; fast_pattern; distance:-12; within:12; sid:10120451; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tx.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-tx.com"; fast_pattern; distance:-12; within:12; sid:10120452; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tx.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-tx.com"; fast_pattern; distance:-12; within:12; sid:10120453; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ut.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ut.com"; fast_pattern; distance:-12; within:12; sid:10120454; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ut.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ut.com"; fast_pattern; distance:-12; within:12; sid:10120455; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-va.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-va.com"; fast_pattern; distance:-12; within:12; sid:10120456; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-va.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-va.com"; fast_pattern; distance:-12; within:12; sid:10120457; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-vt.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-vt.com"; fast_pattern; distance:-12; within:12; sid:10120458; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-vt.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-vt.com"; fast_pattern; distance:-12; within:12; sid:10120459; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wa.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wa.com"; fast_pattern; distance:-12; within:12; sid:10120460; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wa.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wa.com"; fast_pattern; distance:-12; within:12; sid:10120461; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wi.com"; fast_pattern; distance:-12; within:12; sid:10120462; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wi.com"; fast_pattern; distance:-12; within:12; sid:10120463; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wv.com"; fast_pattern; distance:-12; within:12; sid:10120464; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wv.com"; fast_pattern; distance:-12; within:12; sid:10120465; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wy.com"; fast_pattern; distance:-12; within:12; sid:10120466; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wy.com"; fast_pattern; distance:-12; within:12; sid:10120467; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ftpaccess.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftpaccess.cc"; fast_pattern; distance:-13; within:13; sid:10120468; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ftpaccess.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftpaccess.cc"; fast_pattern; distance:-13; within:13; sid:10120469; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain fuettertdasnetz.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fuettertdasnetz.de"; fast_pattern; distance:-19; within:19; sid:10120470; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain fuettertdasnetz.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fuettertdasnetz.de"; fast_pattern; distance:-19; within:19; sid:10120471; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-host.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".game-host.org"; fast_pattern; distance:-14; within:14; sid:10120472; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-host.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".game-host.org"; fast_pattern; distance:-14; within:14; sid:10120473; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-server.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".game-server.cc"; fast_pattern; distance:-15; within:15; sid:10120474; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-server.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".game-server.cc"; fast_pattern; distance:-15; within:15; sid:10120475; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain getmyip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".getmyip.com"; fast_pattern; distance:-12; within:12; sid:10120476; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain getmyip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".getmyip.com"; fast_pattern; distance:-12; within:12; sid:10120477; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gets-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gets-it.net"; fast_pattern; distance:-12; within:12; sid:10120478; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gets-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gets-it.net"; fast_pattern; distance:-12; within:12; sid:10120479; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain go.dyndns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".go.dyndns.org"; fast_pattern; distance:-14; within:14; sid:10120480; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain go.dyndns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".go.dyndns.org"; fast_pattern; distance:-14; within:14; sid:10120481; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotdns.com"; fast_pattern; distance:-11; within:11; sid:10120482; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotdns.com"; fast_pattern; distance:-11; within:11; sid:10120483; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotdns.org"; fast_pattern; distance:-11; within:11; sid:10120484; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotdns.org"; fast_pattern; distance:-11; within:11; sid:10120485; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-the.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".groks-the.info"; fast_pattern; distance:-15; within:15; sid:10120486; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-the.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".groks-the.info"; fast_pattern; distance:-15; within:15; sid:10120487; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-this.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".groks-this.info"; fast_pattern; distance:-16; within:16; sid:10120488; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-this.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".groks-this.info"; fast_pattern; distance:-16; within:16; sid:10120489; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ham-radio-op.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ham-radio-op.net"; fast_pattern; distance:-17; within:17; sid:10120490; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ham-radio-op.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ham-radio-op.net"; fast_pattern; distance:-17; within:17; sid:10120491; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain here-for-more.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".here-for-more.info"; fast_pattern; distance:-19; within:19; sid:10120492; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain here-for-more.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".here-for-more.info"; fast_pattern; distance:-19; within:19; sid:10120493; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hobby-site.com"; fast_pattern; distance:-15; within:15; sid:10120494; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hobby-site.com"; fast_pattern; distance:-15; within:15; sid:10120495; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hobby-site.org"; fast_pattern; distance:-15; within:15; sid:10120496; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hobby-site.org"; fast_pattern; distance:-15; within:15; sid:10120497; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain home.dyndns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".home.dyndns.org"; fast_pattern; distance:-16; within:16; sid:10120498; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain home.dyndns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".home.dyndns.org"; fast_pattern; distance:-16; within:16; sid:10120499; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homedns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homedns.org"; fast_pattern; distance:-12; within:12; sid:10120500; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homedns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homedns.org"; fast_pattern; distance:-12; within:12; sid:10120501; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeftp.net"; fast_pattern; distance:-12; within:12; sid:10120502; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeftp.net"; fast_pattern; distance:-12; within:12; sid:10120503; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeftp.org"; fast_pattern; distance:-12; within:12; sid:10120504; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeftp.org"; fast_pattern; distance:-12; within:12; sid:10120505; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeip.net"; fast_pattern; distance:-11; within:11; sid:10120506; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeip.net"; fast_pattern; distance:-11; within:11; sid:10120507; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinux.com"; fast_pattern; distance:-14; within:14; sid:10120508; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinux.com"; fast_pattern; distance:-14; within:14; sid:10120509; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinux.net"; fast_pattern; distance:-14; within:14; sid:10120510; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinux.net"; fast_pattern; distance:-14; within:14; sid:10120511; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinux.org"; fast_pattern; distance:-14; within:14; sid:10120512; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinux.org"; fast_pattern; distance:-14; within:14; sid:10120513; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeunix.com"; fast_pattern; distance:-13; within:13; sid:10120514; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeunix.com"; fast_pattern; distance:-13; within:13; sid:10120515; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeunix.net"; fast_pattern; distance:-13; within:13; sid:10120516; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeunix.net"; fast_pattern; distance:-13; within:13; sid:10120517; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeunix.org"; fast_pattern; distance:-13; within:13; sid:10120518; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeunix.org"; fast_pattern; distance:-13; within:13; sid:10120519; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain iamallama.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iamallama.com"; fast_pattern; distance:-14; within:14; sid:10120520; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain iamallama.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iamallama.com"; fast_pattern; distance:-14; within:14; sid:10120521; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain in-the-band.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".in-the-band.net"; fast_pattern; distance:-16; within:16; sid:10120522; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain in-the-band.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".in-the-band.net"; fast_pattern; distance:-16; within:16; sid:10120523; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-anarchist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-anarchist.com"; fast_pattern; distance:-19; within:19; sid:10120524; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-anarchist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-anarchist.com"; fast_pattern; distance:-19; within:19; sid:10120525; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-blogger.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-blogger.com"; fast_pattern; distance:-17; within:17; sid:10120526; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-blogger.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-blogger.com"; fast_pattern; distance:-17; within:17; sid:10120527; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bookkeeper.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-bookkeeper.com"; fast_pattern; distance:-20; within:20; sid:10120528; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bookkeeper.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-bookkeeper.com"; fast_pattern; distance:-20; within:20; sid:10120529; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bruinsfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-bruinsfan.org"; fast_pattern; distance:-19; within:19; sid:10120530; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bruinsfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-bruinsfan.org"; fast_pattern; distance:-19; within:19; sid:10120531; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bulls-fan.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-bulls-fan.com"; fast_pattern; distance:-19; within:19; sid:10120532; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bulls-fan.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-bulls-fan.com"; fast_pattern; distance:-19; within:19; sid:10120533; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-candidate.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-candidate.org"; fast_pattern; distance:-19; within:19; sid:10120534; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-candidate.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-candidate.org"; fast_pattern; distance:-19; within:19; sid:10120535; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-caterer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-caterer.com"; fast_pattern; distance:-17; within:17; sid:10120536; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-caterer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-caterer.com"; fast_pattern; distance:-17; within:17; sid:10120537; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-celticsfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-celticsfan.org"; fast_pattern; distance:-20; within:20; sid:10120538; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-celticsfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-celticsfan.org"; fast_pattern; distance:-20; within:20; sid:10120539; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-chef.com"; fast_pattern; distance:-14; within:14; sid:10120540; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-chef.com"; fast_pattern; distance:-14; within:14; sid:10120541; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-chef.net"; fast_pattern; distance:-14; within:14; sid:10120542; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-chef.net"; fast_pattern; distance:-14; within:14; sid:10120543; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-chef.org"; fast_pattern; distance:-14; within:14; sid:10120544; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-chef.org"; fast_pattern; distance:-14; within:14; sid:10120545; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-conservative.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-conservative.com"; fast_pattern; distance:-22; within:22; sid:10120546; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-conservative.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-conservative.com"; fast_pattern; distance:-22; within:22; sid:10120547; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cpa.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-cpa.com"; fast_pattern; distance:-13; within:13; sid:10120548; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cpa.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-cpa.com"; fast_pattern; distance:-13; within:13; sid:10120549; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cubicle-slave.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-cubicle-slave.com"; fast_pattern; distance:-23; within:23; sid:10120550; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cubicle-slave.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-cubicle-slave.com"; fast_pattern; distance:-23; within:23; sid:10120551; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-democrat.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-democrat.com"; fast_pattern; distance:-18; within:18; sid:10120552; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-democrat.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-democrat.com"; fast_pattern; distance:-18; within:18; sid:10120553; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-designer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-designer.com"; fast_pattern; distance:-18; within:18; sid:10120554; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-designer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-designer.com"; fast_pattern; distance:-18; within:18; sid:10120555; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-doctor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-doctor.com"; fast_pattern; distance:-16; within:16; sid:10120556; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-doctor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-doctor.com"; fast_pattern; distance:-16; within:16; sid:10120557; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-financialadvisor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-financialadvisor.com"; fast_pattern; distance:-26; within:26; sid:10120558; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-financialadvisor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-financialadvisor.com"; fast_pattern; distance:-26; within:26; sid:10120559; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-geek.com"; fast_pattern; distance:-14; within:14; sid:10120560; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-geek.com"; fast_pattern; distance:-14; within:14; sid:10120561; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-geek.net"; fast_pattern; distance:-14; within:14; sid:10120562; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-geek.net"; fast_pattern; distance:-14; within:14; sid:10120563; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-geek.org"; fast_pattern; distance:-14; within:14; sid:10120564; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-geek.org"; fast_pattern; distance:-14; within:14; sid:10120565; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-green.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-green.com"; fast_pattern; distance:-15; within:15; sid:10120566; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-green.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-green.com"; fast_pattern; distance:-15; within:15; sid:10120567; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-guru.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-guru.com"; fast_pattern; distance:-14; within:14; sid:10120568; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-guru.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-guru.com"; fast_pattern; distance:-14; within:14; sid:10120569; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hard-worker.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-hard-worker.com"; fast_pattern; distance:-21; within:21; sid:10120570; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hard-worker.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-hard-worker.com"; fast_pattern; distance:-21; within:21; sid:10120571; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hunter.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-hunter.com"; fast_pattern; distance:-16; within:16; sid:10120572; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hunter.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-hunter.com"; fast_pattern; distance:-16; within:16; sid:10120573; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-knight.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-knight.org"; fast_pattern; distance:-16; within:16; sid:10120574; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-knight.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-knight.org"; fast_pattern; distance:-16; within:16; sid:10120575; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-landscaper.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-landscaper.com"; fast_pattern; distance:-20; within:20; sid:10120576; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-landscaper.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-landscaper.com"; fast_pattern; distance:-20; within:20; sid:10120577; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-lawyer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-lawyer.com"; fast_pattern; distance:-16; within:16; sid:10120578; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-lawyer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-lawyer.com"; fast_pattern; distance:-16; within:16; sid:10120579; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-liberal.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-liberal.com"; fast_pattern; distance:-17; within:17; sid:10120580; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-liberal.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-liberal.com"; fast_pattern; distance:-17; within:17; sid:10120581; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-libertarian.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-libertarian.com"; fast_pattern; distance:-21; within:21; sid:10120582; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-libertarian.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-libertarian.com"; fast_pattern; distance:-21; within:21; sid:10120583; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-linux-user.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-linux-user.org"; fast_pattern; distance:-20; within:20; sid:10120584; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-linux-user.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-linux-user.org"; fast_pattern; distance:-20; within:20; sid:10120585; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-llama.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-llama.com"; fast_pattern; distance:-15; within:15; sid:10120586; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-llama.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-llama.com"; fast_pattern; distance:-15; within:15; sid:10120587; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-musician.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-musician.com"; fast_pattern; distance:-18; within:18; sid:10120588; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-musician.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-musician.com"; fast_pattern; distance:-18; within:18; sid:10120589; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nascarfan.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-nascarfan.com"; fast_pattern; distance:-19; within:19; sid:10120590; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nascarfan.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-nascarfan.com"; fast_pattern; distance:-19; within:19; sid:10120591; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nurse.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-nurse.com"; fast_pattern; distance:-15; within:15; sid:10120592; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nurse.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-nurse.com"; fast_pattern; distance:-15; within:15; sid:10120593; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-painter.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-painter.com"; fast_pattern; distance:-17; within:17; sid:10120594; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-painter.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-painter.com"; fast_pattern; distance:-17; within:17; sid:10120595; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-patsfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-patsfan.org"; fast_pattern; distance:-17; within:17; sid:10120596; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-patsfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-patsfan.org"; fast_pattern; distance:-17; within:17; sid:10120597; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-personaltrainer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-personaltrainer.com"; fast_pattern; distance:-25; within:25; sid:10120598; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-personaltrainer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-personaltrainer.com"; fast_pattern; distance:-25; within:25; sid:10120599; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-photographer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-photographer.com"; fast_pattern; distance:-22; within:22; sid:10120600; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-photographer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-photographer.com"; fast_pattern; distance:-22; within:22; sid:10120601; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-player.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-player.com"; fast_pattern; distance:-16; within:16; sid:10120602; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-player.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-player.com"; fast_pattern; distance:-16; within:16; sid:10120603; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-republican.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-republican.com"; fast_pattern; distance:-20; within:20; sid:10120604; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-republican.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-republican.com"; fast_pattern; distance:-20; within:20; sid:10120605; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-rockstar.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-rockstar.com"; fast_pattern; distance:-18; within:18; sid:10120606; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-rockstar.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-rockstar.com"; fast_pattern; distance:-18; within:18; sid:10120607; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-socialist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-socialist.com"; fast_pattern; distance:-19; within:19; sid:10120608; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-socialist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-socialist.com"; fast_pattern; distance:-19; within:19; sid:10120609; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-soxfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-soxfan.org"; fast_pattern; distance:-16; within:16; sid:10120610; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-soxfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-soxfan.org"; fast_pattern; distance:-16; within:16; sid:10120611; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-student.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-student.com"; fast_pattern; distance:-17; within:17; sid:10120612; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-student.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-student.com"; fast_pattern; distance:-17; within:17; sid:10120613; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-teacher.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-teacher.com"; fast_pattern; distance:-17; within:17; sid:10120614; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-teacher.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-teacher.com"; fast_pattern; distance:-17; within:17; sid:10120615; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-techie.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-techie.com"; fast_pattern; distance:-16; within:16; sid:10120616; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-techie.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-techie.com"; fast_pattern; distance:-16; within:16; sid:10120617; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-therapist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-therapist.com"; fast_pattern; distance:-19; within:19; sid:10120618; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-therapist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-therapist.com"; fast_pattern; distance:-19; within:19; sid:10120619; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-accountant.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-accountant.com"; fast_pattern; distance:-21; within:21; sid:10120620; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-accountant.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-accountant.com"; fast_pattern; distance:-21; within:21; sid:10120621; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-actor.com"; fast_pattern; distance:-16; within:16; sid:10120622; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-actor.com"; fast_pattern; distance:-16; within:16; sid:10120623; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actress.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-actress.com"; fast_pattern; distance:-18; within:18; sid:10120624; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actress.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-actress.com"; fast_pattern; distance:-18; within:18; sid:10120625; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-anarchist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-anarchist.com"; fast_pattern; distance:-20; within:20; sid:10120626; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-anarchist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-anarchist.com"; fast_pattern; distance:-20; within:20; sid:10120627; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-artist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-artist.com"; fast_pattern; distance:-17; within:17; sid:10120628; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-artist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-artist.com"; fast_pattern; distance:-17; within:17; sid:10120629; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-engineer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-engineer.com"; fast_pattern; distance:-19; within:19; sid:10120630; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-engineer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-engineer.com"; fast_pattern; distance:-19; within:19; sid:10120631; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-entertainer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-entertainer.com"; fast_pattern; distance:-22; within:22; sid:10120632; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-entertainer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-entertainer.com"; fast_pattern; distance:-22; within:22; sid:10120633; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-by.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-by.us"; fast_pattern; distance:-9; within:9; sid:10120634; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-by.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-by.us"; fast_pattern; distance:-9; within:9; sid:10120635; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-certified.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-certified.com"; fast_pattern; distance:-17; within:17; sid:10120636; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-certified.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-certified.com"; fast_pattern; distance:-17; within:17; sid:10120637; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-found.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-found.org"; fast_pattern; distance:-13; within:13; sid:10120638; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-found.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-found.org"; fast_pattern; distance:-13; within:13; sid:10120639; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-gone.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-gone.com"; fast_pattern; distance:-12; within:12; sid:10120640; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-gone.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-gone.com"; fast_pattern; distance:-12; within:12; sid:10120641; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-anime.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-anime.com"; fast_pattern; distance:-18; within:18; sid:10120642; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-anime.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-anime.com"; fast_pattern; distance:-18; within:18; sid:10120643; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cars.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-cars.com"; fast_pattern; distance:-17; within:17; sid:10120644; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cars.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-cars.com"; fast_pattern; distance:-17; within:17; sid:10120645; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cartoons.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-cartoons.com"; fast_pattern; distance:-21; within:21; sid:10120646; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cartoons.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-cartoons.com"; fast_pattern; distance:-21; within:21; sid:10120647; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-games.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-games.com"; fast_pattern; distance:-18; within:18; sid:10120648; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-games.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-games.com"; fast_pattern; distance:-18; within:18; sid:10120649; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-leet.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-leet.com"; fast_pattern; distance:-12; within:12; sid:10120650; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-leet.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-leet.com"; fast_pattern; distance:-12; within:12; sid:10120651; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-lost.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-lost.org"; fast_pattern; distance:-12; within:12; sid:10120652; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-lost.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-lost.org"; fast_pattern; distance:-12; within:12; sid:10120653; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-not-certified.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-not-certified.com"; fast_pattern; distance:-21; within:21; sid:10120654; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-not-certified.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-not-certified.com"; fast_pattern; distance:-21; within:21; sid:10120655; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-saved.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-saved.org"; fast_pattern; distance:-13; within:13; sid:10120656; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-saved.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-saved.org"; fast_pattern; distance:-13; within:13; sid:10120657; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-slick.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-slick.com"; fast_pattern; distance:-13; within:13; sid:10120658; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-slick.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-slick.com"; fast_pattern; distance:-13; within:13; sid:10120659; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-uberleet.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-uberleet.com"; fast_pattern; distance:-16; within:16; sid:10120660; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-uberleet.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-uberleet.com"; fast_pattern; distance:-16; within:16; sid:10120661; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-bad.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-bad.org"; fast_pattern; distance:-16; within:16; sid:10120662; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-bad.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-bad.org"; fast_pattern; distance:-16; within:16; sid:10120663; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-evil.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-evil.org"; fast_pattern; distance:-17; within:17; sid:10120664; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-evil.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-evil.org"; fast_pattern; distance:-17; within:17; sid:10120665; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-good.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-good.org"; fast_pattern; distance:-17; within:17; sid:10120666; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-good.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-good.org"; fast_pattern; distance:-17; within:17; sid:10120667; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-nice.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-nice.org"; fast_pattern; distance:-17; within:17; sid:10120668; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-nice.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-nice.org"; fast_pattern; distance:-17; within:17; sid:10120669; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-sweet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-sweet.org"; fast_pattern; distance:-18; within:18; sid:10120670; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-sweet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-sweet.org"; fast_pattern; distance:-18; within:18; sid:10120671; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-with-theband.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-with-theband.com"; fast_pattern; distance:-20; within:20; sid:10120672; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-with-theband.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-with-theband.com"; fast_pattern; distance:-20; within:20; sid:10120673; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-geek.com"; fast_pattern; distance:-13; within:13; sid:10120674; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-geek.com"; fast_pattern; distance:-13; within:13; sid:10120675; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-geek.net"; fast_pattern; distance:-13; within:13; sid:10120676; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-geek.net"; fast_pattern; distance:-13; within:13; sid:10120677; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-geek.org"; fast_pattern; distance:-13; within:13; sid:10120678; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-geek.org"; fast_pattern; distance:-13; within:13; sid:10120679; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-hockeynut.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-hockeynut.com"; fast_pattern; distance:-18; within:18; sid:10120680; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-hockeynut.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-hockeynut.com"; fast_pattern; distance:-18; within:18; sid:10120681; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain issmarterthanyou.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".issmarterthanyou.com"; fast_pattern; distance:-21; within:21; sid:10120682; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain issmarterthanyou.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".issmarterthanyou.com"; fast_pattern; distance:-21; within:21; sid:10120683; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isteingeek.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isteingeek.de"; fast_pattern; distance:-14; within:14; sid:10120684; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isteingeek.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isteingeek.de"; fast_pattern; distance:-14; within:14; sid:10120685; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain istmein.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".istmein.de"; fast_pattern; distance:-11; within:11; sid:10120686; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain istmein.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".istmein.de"; fast_pattern; distance:-11; within:11; sid:10120687; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kicks-ass.net"; fast_pattern; distance:-14; within:14; sid:10120688; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kicks-ass.net"; fast_pattern; distance:-14; within:14; sid:10120689; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kicks-ass.org"; fast_pattern; distance:-14; within:14; sid:10120690; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kicks-ass.org"; fast_pattern; distance:-14; within:14; sid:10120691; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain knowsitall.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".knowsitall.info"; fast_pattern; distance:-16; within:16; sid:10120692; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain knowsitall.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".knowsitall.info"; fast_pattern; distance:-16; within:16; sid:10120693; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain land-4-sale.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".land-4-sale.us"; fast_pattern; distance:-15; within:15; sid:10120694; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain land-4-sale.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".land-4-sale.us"; fast_pattern; distance:-15; within:15; sid:10120695; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain lebtimnetz.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lebtimnetz.de"; fast_pattern; distance:-14; within:14; sid:10120696; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain lebtimnetz.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lebtimnetz.de"; fast_pattern; distance:-14; within:14; sid:10120697; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain leitungsen.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".leitungsen.de"; fast_pattern; distance:-14; within:14; sid:10120698; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain leitungsen.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".leitungsen.de"; fast_pattern; distance:-14; within:14; sid:10120699; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likes-pie.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".likes-pie.com"; fast_pattern; distance:-14; within:14; sid:10120700; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likes-pie.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".likes-pie.com"; fast_pattern; distance:-14; within:14; sid:10120701; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likescandy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".likescandy.com"; fast_pattern; distance:-15; within:15; sid:10120702; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likescandy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".likescandy.com"; fast_pattern; distance:-15; within:15; sid:10120703; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain merseine.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".merseine.nu"; fast_pattern; distance:-12; within:12; sid:10120704; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain merseine.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".merseine.nu"; fast_pattern; distance:-12; within:12; sid:10120705; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mine.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mine.nu"; fast_pattern; distance:-8; within:8; sid:10120706; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mine.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mine.nu"; fast_pattern; distance:-8; within:8; sid:10120707; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain misconfused.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".misconfused.org"; fast_pattern; distance:-16; within:16; sid:10120708; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain misconfused.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".misconfused.org"; fast_pattern; distance:-16; within:16; sid:10120709; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mypets.ws"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypets.ws"; fast_pattern; distance:-10; within:10; sid:10120710; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mypets.ws in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypets.ws"; fast_pattern; distance:-10; within:10; sid:10120711; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain myphotos.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myphotos.cc"; fast_pattern; distance:-12; within:12; sid:10120712; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain myphotos.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myphotos.cc"; fast_pattern; distance:-12; within:12; sid:10120713; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain neat-url.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".neat-url.com"; fast_pattern; distance:-13; within:13; sid:10120714; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain neat-url.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".neat-url.com"; fast_pattern; distance:-13; within:13; sid:10120715; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain office-on-the.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".office-on-the.net"; fast_pattern; distance:-18; within:18; sid:10120716; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain office-on-the.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".office-on-the.net"; fast_pattern; distance:-18; within:18; sid:10120717; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain on-the-web.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".on-the-web.tv"; fast_pattern; distance:-14; within:14; sid:10120718; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain on-the-web.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".on-the-web.tv"; fast_pattern; distance:-14; within:14; sid:10120719; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".podzone.net"; fast_pattern; distance:-12; within:12; sid:10120720; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".podzone.net"; fast_pattern; distance:-12; within:12; sid:10120721; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".podzone.org"; fast_pattern; distance:-12; within:12; sid:10120722; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".podzone.org"; fast_pattern; distance:-12; within:12; sid:10120723; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain readmyblog.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".readmyblog.org"; fast_pattern; distance:-15; within:15; sid:10120724; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain readmyblog.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".readmyblog.org"; fast_pattern; distance:-15; within:15; sid:10120725; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain saves-the-whales.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".saves-the-whales.com"; fast_pattern; distance:-21; within:21; sid:10120726; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain saves-the-whales.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".saves-the-whales.com"; fast_pattern; distance:-21; within:21; sid:10120727; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapper-site.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scrapper-site.net"; fast_pattern; distance:-18; within:18; sid:10120728; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapper-site.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scrapper-site.net"; fast_pattern; distance:-18; within:18; sid:10120729; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapping.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scrapping.cc"; fast_pattern; distance:-13; within:13; sid:10120730; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapping.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scrapping.cc"; fast_pattern; distance:-13; within:13; sid:10120731; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.biz"; fast_pattern; distance:-11; within:11; sid:10120732; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.biz"; fast_pattern; distance:-11; within:11; sid:10120733; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.com"; fast_pattern; distance:-11; within:11; sid:10120734; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.com"; fast_pattern; distance:-11; within:11; sid:10120735; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.info"; fast_pattern; distance:-12; within:12; sid:10120736; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.info"; fast_pattern; distance:-12; within:12; sid:10120737; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.net"; fast_pattern; distance:-11; within:11; sid:10120738; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.net"; fast_pattern; distance:-11; within:11; sid:10120739; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.org"; fast_pattern; distance:-11; within:11; sid:10120740; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.org"; fast_pattern; distance:-11; within:11; sid:10120741; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-less.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sells-for-less.com"; fast_pattern; distance:-19; within:19; sid:10120742; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-less.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sells-for-less.com"; fast_pattern; distance:-19; within:19; sid:10120743; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-u.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sells-for-u.com"; fast_pattern; distance:-16; within:16; sid:10120744; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-u.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sells-for-u.com"; fast_pattern; distance:-16; within:16; sid:10120745; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sells-it.net"; fast_pattern; distance:-13; within:13; sid:10120746; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sells-it.net"; fast_pattern; distance:-13; within:13; sid:10120747; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sellsyourhome.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sellsyourhome.org"; fast_pattern; distance:-18; within:18; sid:10120748; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sellsyourhome.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sellsyourhome.org"; fast_pattern; distance:-18; within:18; sid:10120749; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebbs.com"; fast_pattern; distance:-13; within:13; sid:10120750; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebbs.com"; fast_pattern; distance:-13; within:13; sid:10120751; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebbs.net"; fast_pattern; distance:-13; within:13; sid:10120752; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebbs.net"; fast_pattern; distance:-13; within:13; sid:10120753; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebbs.org"; fast_pattern; distance:-13; within:13; sid:10120754; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebbs.org"; fast_pattern; distance:-13; within:13; sid:10120755; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveftp.net"; fast_pattern; distance:-13; within:13; sid:10120756; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveftp.net"; fast_pattern; distance:-13; within:13; sid:10120757; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveftp.org"; fast_pattern; distance:-13; within:13; sid:10120758; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveftp.org"; fast_pattern; distance:-13; within:13; sid:10120759; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servegame.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servegame.org"; fast_pattern; distance:-14; within:14; sid:10120760; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servegame.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servegame.org"; fast_pattern; distance:-14; within:14; sid:10120761; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain shacknet.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shacknet.nu"; fast_pattern; distance:-12; within:12; sid:10120762; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain shacknet.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shacknet.nu"; fast_pattern; distance:-12; within:12; sid:10120763; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain simple-url.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".simple-url.com"; fast_pattern; distance:-15; within:15; sid:10120764; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain simple-url.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".simple-url.com"; fast_pattern; distance:-15; within:15; sid:10120765; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain space-to-rent.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".space-to-rent.com"; fast_pattern; distance:-18; within:18; sid:10120766; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain space-to-rent.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".space-to-rent.com"; fast_pattern; distance:-18; within:18; sid:10120767; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stuff-4-sale.org"; fast_pattern; distance:-17; within:17; sid:10120768; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stuff-4-sale.org"; fast_pattern; distance:-17; within:17; sid:10120769; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stuff-4-sale.us"; fast_pattern; distance:-16; within:16; sid:10120770; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stuff-4-sale.us"; fast_pattern; distance:-16; within:16; sid:10120771; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain teaches-yoga.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".teaches-yoga.com"; fast_pattern; distance:-17; within:17; sid:10120772; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain teaches-yoga.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".teaches-yoga.com"; fast_pattern; distance:-17; within:17; sid:10120773; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain thruhere.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".thruhere.net"; fast_pattern; distance:-13; within:13; sid:10120774; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain thruhere.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".thruhere.net"; fast_pattern; distance:-13; within:13; sid:10120775; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain traeumtgerade.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".traeumtgerade.de"; fast_pattern; distance:-17; within:17; sid:10120776; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain traeumtgerade.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".traeumtgerade.de"; fast_pattern; distance:-17; within:17; sid:10120777; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.biz"; fast_pattern; distance:-11; within:11; sid:10120778; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.biz"; fast_pattern; distance:-11; within:11; sid:10120779; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.info"; fast_pattern; distance:-12; within:12; sid:10120780; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.info"; fast_pattern; distance:-12; within:12; sid:10120781; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.net"; fast_pattern; distance:-11; within:11; sid:10120782; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.net"; fast_pattern; distance:-11; within:11; sid:10120783; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.org"; fast_pattern; distance:-11; within:11; sid:10120784; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.org"; fast_pattern; distance:-11; within:11; sid:10120785; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain worse-than.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".worse-than.tv"; fast_pattern; distance:-14; within:14; sid:10120786; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain worse-than.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".worse-than.tv"; fast_pattern; distance:-14; within:14; sid:10120787; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain writesthisblog.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".writesthisblog.com"; fast_pattern; distance:-19; within:19; sid:10120788; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain writesthisblog.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".writesthisblog.com"; fast_pattern; distance:-19; within:19; sid:10120789; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain publicvm.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".publicvm.com"; fast_pattern; distance:-13; within:13; sid:10120790; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain publicvm.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".publicvm.com"; fast_pattern; distance:-13; within:13; sid:10120791; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain linkpc.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".linkpc.net"; fast_pattern; distance:-11; within:11; sid:10120792; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain linkpc.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".linkpc.net"; fast_pattern; distance:-11; within:11; sid:10120793; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mooo.com"; fast_pattern; distance:-9; within:9; sid:10120794; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mooo.com"; fast_pattern; distance:-9; within:9; sid:10120795; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain chickenkiller.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".chickenkiller.com"; fast_pattern; distance:-18; within:18; sid:10120796; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain chickenkiller.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".chickenkiller.com"; fast_pattern; distance:-18; within:18; sid:10120797; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain us.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".us.to"; fast_pattern; distance:-6; within:6; sid:10120798; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain us.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".us.to"; fast_pattern; distance:-6; within:6; sid:10120799; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain strangled.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".strangled.net"; fast_pattern; distance:-14; within:14; sid:10120800; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain strangled.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".strangled.net"; fast_pattern; distance:-14; within:14; sid:10120801; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ignorelist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ignorelist.com"; fast_pattern; distance:-15; within:15; sid:10120802; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ignorelist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ignorelist.com"; fast_pattern; distance:-15; within:15; sid:10120803; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uk.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".uk.to"; fast_pattern; distance:-6; within:6; sid:10120804; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uk.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".uk.to"; fast_pattern; distance:-6; within:6; sid:10120805; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crabdance.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".crabdance.com"; fast_pattern; distance:-14; within:14; sid:10120806; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crabdance.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".crabdance.com"; fast_pattern; distance:-14; within:14; sid:10120807; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.tm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".info.tm"; fast_pattern; distance:-8; within:8; sid:10120808; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.tm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".info.tm"; fast_pattern; distance:-8; within:8; sid:10120809; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain homenet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homenet.org"; fast_pattern; distance:-12; within:12; sid:10120810; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain homenet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homenet.org"; fast_pattern; distance:-12; within:12; sid:10120811; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jumpingcrab.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jumpingcrab.com"; fast_pattern; distance:-16; within:16; sid:10120812; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jumpingcrab.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jumpingcrab.com"; fast_pattern; distance:-16; within:16; sid:10120813; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain twilightparadox.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".twilightparadox.com"; fast_pattern; distance:-20; within:20; sid:10120814; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain twilightparadox.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".twilightparadox.com"; fast_pattern; distance:-20; within:20; sid:10120815; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain biz.tm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".biz.tm"; fast_pattern; distance:-7; within:7; sid:10120816; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain biz.tm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".biz.tm"; fast_pattern; distance:-7; within:7; sid:10120817; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain continent.kz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".continent.kz"; fast_pattern; distance:-13; within:13; sid:10120818; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain continent.kz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".continent.kz"; fast_pattern; distance:-13; within:13; sid:10120819; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yao.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".yao.cl"; fast_pattern; distance:-7; within:7; sid:10120820; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yao.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".yao.cl"; fast_pattern; distance:-7; within:7; sid:10120821; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ax.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ax.lt"; fast_pattern; distance:-6; within:6; sid:10120822; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ax.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ax.lt"; fast_pattern; distance:-6; within:6; sid:10120823; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privatedns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".privatedns.org"; fast_pattern; distance:-15; within:15; sid:10120824; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privatedns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".privatedns.org"; fast_pattern; distance:-15; within:15; sid:10120825; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hacked.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hacked.jp"; fast_pattern; distance:-10; within:10; sid:10120826; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hacked.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hacked.jp"; fast_pattern; distance:-10; within:10; sid:10120827; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ftp.sh"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftp.sh"; fast_pattern; distance:-7; within:7; sid:10120828; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ftp.sh in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftp.sh"; fast_pattern; distance:-7; within:7; sid:10120829; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain now.im"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".now.im"; fast_pattern; distance:-7; within:7; sid:10120830; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain now.im in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".now.im"; fast_pattern; distance:-7; within:7; sid:10120831; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bep.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bep.co.id"; fast_pattern; distance:-10; within:10; sid:10120832; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bep.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bep.co.id"; fast_pattern; distance:-10; within:10; sid:10120833; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain undo.it"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".undo.it"; fast_pattern; distance:-8; within:8; sid:10120834; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain undo.it in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".undo.it"; fast_pattern; distance:-8; within:8; sid:10120835; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bot.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bot.nu"; fast_pattern; distance:-7; within:7; sid:10120836; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bot.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bot.nu"; fast_pattern; distance:-7; within:7; sid:10120837; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kalbas.com.vn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kalbas.com.vn"; fast_pattern; distance:-14; within:14; sid:10120838; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kalbas.com.vn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kalbas.com.vn"; fast_pattern; distance:-14; within:14; sid:10120839; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qc.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qc.to"; fast_pattern; distance:-6; within:6; sid:10120840; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qc.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qc.to"; fast_pattern; distance:-6; within:6; sid:10120841; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 3dxtras.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3dxtras.com"; fast_pattern; distance:-12; within:12; sid:10120842; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 3dxtras.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3dxtras.com"; fast_pattern; distance:-12; within:12; sid:10120843; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pwnz.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pwnz.org"; fast_pattern; distance:-9; within:9; sid:10120844; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pwnz.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pwnz.org"; fast_pattern; distance:-9; within:9; sid:10120845; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mine.bz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mine.bz"; fast_pattern; distance:-8; within:8; sid:10120846; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mine.bz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mine.bz"; fast_pattern; distance:-8; within:8; sid:10120847; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dynet.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynet.com"; fast_pattern; distance:-10; within:10; sid:10120848; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dynet.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynet.com"; fast_pattern; distance:-10; within:10; sid:10120849; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.gf"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".info.gf"; fast_pattern; distance:-8; within:8; sid:10120850; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.gf in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".info.gf"; fast_pattern; distance:-8; within:8; sid:10120851; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain my.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".my.to"; fast_pattern; distance:-6; within:6; sid:10120852; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain my.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".my.to"; fast_pattern; distance:-6; within:6; sid:10120853; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain allowed.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".allowed.org"; fast_pattern; distance:-12; within:12; sid:10120854; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain allowed.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".allowed.org"; fast_pattern; distance:-12; within:12; sid:10120855; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain god.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".god.jp"; fast_pattern; distance:-7; within:7; sid:10120856; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain god.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".god.jp"; fast_pattern; distance:-7; within:7; sid:10120857; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain home.kg"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".home.kg"; fast_pattern; distance:-8; within:8; sid:10120858; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain home.kg in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".home.kg"; fast_pattern; distance:-8; within:8; sid:10120859; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shop.tm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shop.tm"; fast_pattern; distance:-8; within:8; sid:10120860; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shop.tm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shop.tm"; fast_pattern; distance:-8; within:8; sid:10120861; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ro.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ro.lt"; fast_pattern; distance:-6; within:6; sid:10120862; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ro.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ro.lt"; fast_pattern; distance:-6; within:6; sid:10120863; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain t28.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".t28.net"; fast_pattern; distance:-8; within:8; sid:10120864; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain t28.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".t28.net"; fast_pattern; distance:-8; within:8; sid:10120865; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftnoob.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".minecraftnoob.com"; fast_pattern; distance:-18; within:18; sid:10120866; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftnoob.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".minecraftnoob.com"; fast_pattern; distance:-18; within:18; sid:10120867; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 69.mu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".69.mu"; fast_pattern; distance:-6; within:6; sid:10120868; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 69.mu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".69.mu"; fast_pattern; distance:-6; within:6; sid:10120869; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain spacetechnology.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".spacetechnology.net"; fast_pattern; distance:-20; within:20; sid:10120870; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain spacetechnology.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".spacetechnology.net"; fast_pattern; distance:-20; within:20; sid:10120871; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gw.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gw.lt"; fast_pattern; distance:-6; within:6; sid:10120872; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gw.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gw.lt"; fast_pattern; distance:-6; within:6; sid:10120873; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain root.sx"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".root.sx"; fast_pattern; distance:-8; within:8; sid:10120874; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain root.sx in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".root.sx"; fast_pattern; distance:-8; within:8; sid:10120875; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nx.tc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nx.tc"; fast_pattern; distance:-6; within:6; sid:10120876; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nx.tc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nx.tc"; fast_pattern; distance:-6; within:6; sid:10120877; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain k.vu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".k.vu"; fast_pattern; distance:-5; within:5; sid:10120878; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain k.vu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".k.vu"; fast_pattern; distance:-5; within:5; sid:10120879; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mooo.info"; fast_pattern; distance:-10; within:10; sid:10120880; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mooo.info"; fast_pattern; distance:-10; within:10; sid:10120881; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain farted.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".farted.net"; fast_pattern; distance:-11; within:11; sid:10120882; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain farted.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".farted.net"; fast_pattern; distance:-11; within:11; sid:10120883; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftr.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".minecraftr.us"; fast_pattern; distance:-14; within:14; sid:10120884; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftr.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".minecraftr.us"; fast_pattern; distance:-14; within:14; sid:10120885; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain port0.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".port0.org"; fast_pattern; distance:-10; within:10; sid:10120886; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain port0.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".port0.org"; fast_pattern; distance:-10; within:10; sid:10120887; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyforever.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".happyforever.com"; fast_pattern; distance:-17; within:17; sid:10120888; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyforever.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".happyforever.com"; fast_pattern; distance:-17; within:17; sid:10120889; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cr.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cr.rs"; fast_pattern; distance:-6; within:6; sid:10120890; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cr.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cr.rs"; fast_pattern; distance:-6; within:6; sid:10120891; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bigbox.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bigbox.info"; fast_pattern; distance:-12; within:12; sid:10120892; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bigbox.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bigbox.info"; fast_pattern; distance:-12; within:12; sid:10120893; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 1337.cx"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".1337.cx"; fast_pattern; distance:-8; within:8; sid:10120894; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 1337.cx in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".1337.cx"; fast_pattern; distance:-8; within:8; sid:10120895; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evils.in"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".evils.in"; fast_pattern; distance:-9; within:9; sid:10120896; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evils.in in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".evils.in"; fast_pattern; distance:-9; within:9; sid:10120897; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain csproject.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".csproject.org"; fast_pattern; distance:-14; within:14; sid:10120898; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain csproject.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".csproject.org"; fast_pattern; distance:-14; within:14; sid:10120899; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain verymad.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".verymad.net"; fast_pattern; distance:-12; within:12; sid:10120900; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain verymad.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".verymad.net"; fast_pattern; distance:-12; within:12; sid:10120901; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fr.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fr.to"; fast_pattern; distance:-6; within:6; sid:10120902; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fr.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fr.to"; fast_pattern; distance:-6; within:6; sid:10120903; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain serverpit.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serverpit.com"; fast_pattern; distance:-14; within:14; sid:10120904; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain serverpit.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serverpit.com"; fast_pattern; distance:-14; within:14; sid:10120905; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vr.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vr.lt"; fast_pattern; distance:-6; within:6; sid:10120906; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vr.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vr.lt"; fast_pattern; distance:-6; within:6; sid:10120907; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain punked.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".punked.us"; fast_pattern; distance:-10; within:10; sid:10120908; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain punked.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".punked.us"; fast_pattern; distance:-10; within:10; sid:10120909; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain suka.se"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".suka.se"; fast_pattern; distance:-8; within:8; sid:10120910; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain suka.se in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".suka.se"; fast_pattern; distance:-8; within:8; sid:10120911; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h4ck.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".h4ck.me"; fast_pattern; distance:-8; within:8; sid:10120912; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h4ck.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".h4ck.me"; fast_pattern; distance:-8; within:8; sid:10120913; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain soon.it"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".soon.it"; fast_pattern; distance:-8; within:8; sid:10120914; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain soon.it in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".soon.it"; fast_pattern; distance:-8; within:8; sid:10120915; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thcgirls.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".thcgirls.com"; fast_pattern; distance:-13; within:13; sid:10120916; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thcgirls.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".thcgirls.com"; fast_pattern; distance:-13; within:13; sid:10120917; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iz.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iz.rs"; fast_pattern; distance:-6; within:6; sid:10120918; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iz.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iz.rs"; fast_pattern; distance:-6; within:6; sid:10120919; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain madhacker.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".madhacker.biz"; fast_pattern; distance:-14; within:14; sid:10120920; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain madhacker.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".madhacker.biz"; fast_pattern; distance:-14; within:14; sid:10120921; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fedea.com.ar"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fedea.com.ar"; fast_pattern; distance:-13; within:13; sid:10120922; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fedea.com.ar in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fedea.com.ar"; fast_pattern; distance:-13; within:13; sid:10120923; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain icfar.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".icfar.com"; fast_pattern; distance:-10; within:10; sid:10120924; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain icfar.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".icfar.com"; fast_pattern; distance:-10; within:10; sid:10120925; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain r-o-o-t.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".r-o-o-t.net"; fast_pattern; distance:-12; within:12; sid:10120926; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain r-o-o-t.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".r-o-o-t.net"; fast_pattern; distance:-12; within:12; sid:10120927; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 404.mn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".404.mn"; fast_pattern; distance:-7; within:7; sid:10120928; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 404.mn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".404.mn"; fast_pattern; distance:-7; within:7; sid:10120929; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kir22.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kir22.ru"; fast_pattern; distance:-9; within:9; sid:10120930; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kir22.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kir22.ru"; fast_pattern; distance:-9; within:9; sid:10120931; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain byte4byte.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".byte4byte.com"; fast_pattern; distance:-14; within:14; sid:10120932; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain byte4byte.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".byte4byte.com"; fast_pattern; distance:-14; within:14; sid:10120933; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 120v.ac"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".120v.ac"; fast_pattern; distance:-8; within:8; sid:10120934; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 120v.ac in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".120v.ac"; fast_pattern; distance:-8; within:8; sid:10120935; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain d-n-s.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".d-n-s.name"; fast_pattern; distance:-11; within:11; sid:10120936; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain d-n-s.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".d-n-s.name"; fast_pattern; distance:-11; within:11; sid:10120937; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h-o-s-t.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".h-o-s-t.name"; fast_pattern; distance:-13; within:13; sid:10120938; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h-o-s-t.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".h-o-s-t.name"; fast_pattern; distance:-13; within:13; sid:10120939; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psybnc.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".psybnc.org"; fast_pattern; distance:-11; within:11; sid:10120940; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psybnc.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".psybnc.org"; fast_pattern; distance:-11; within:11; sid:10120941; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zanity.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zanity.net"; fast_pattern; distance:-11; within:11; sid:10120942; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zanity.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zanity.net"; fast_pattern; distance:-11; within:11; sid:10120943; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hashcube.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hashcube.com"; fast_pattern; distance:-13; within:13; sid:10120944; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hashcube.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hashcube.com"; fast_pattern; distance:-13; within:13; sid:10120945; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ohbah.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ohbah.com"; fast_pattern; distance:-10; within:10; sid:10120946; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ohbah.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ohbah.com"; fast_pattern; distance:-10; within:10; sid:10120947; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 24-7.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".24-7.ro"; fast_pattern; distance:-8; within:8; sid:10120948; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 24-7.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".24-7.ro"; fast_pattern; distance:-8; within:8; sid:10120949; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mm.my"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mm.my"; fast_pattern; distance:-6; within:6; sid:10120950; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mm.my in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mm.my"; fast_pattern; distance:-6; within:6; sid:10120951; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iiiii.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iiiii.info"; fast_pattern; distance:-11; within:11; sid:10120952; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iiiii.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iiiii.info"; fast_pattern; distance:-11; within:11; sid:10120953; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain abuser.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".abuser.eu"; fast_pattern; distance:-10; within:10; sid:10120954; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain abuser.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".abuser.eu"; fast_pattern; distance:-10; within:10; sid:10120955; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain star.is"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".star.is"; fast_pattern; distance:-8; within:8; sid:10120956; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain star.is in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".star.is"; fast_pattern; distance:-8; within:8; sid:10120957; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain epicgamer.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".epicgamer.org"; fast_pattern; distance:-14; within:14; sid:10120958; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain epicgamer.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".epicgamer.org"; fast_pattern; distance:-14; within:14; sid:10120959; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vietnam.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vietnam.ro"; fast_pattern; distance:-11; within:11; sid:10120960; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vietnam.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vietnam.ro"; fast_pattern; distance:-11; within:11; sid:10120961; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hackquest.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hackquest.com"; fast_pattern; distance:-14; within:14; sid:10120962; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hackquest.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hackquest.com"; fast_pattern; distance:-14; within:14; sid:10120963; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain photo-frame.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".photo-frame.com"; fast_pattern; distance:-16; within:16; sid:10120964; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain photo-frame.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".photo-frame.com"; fast_pattern; distance:-16; within:16; sid:10120965; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iminecraft.se"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iminecraft.se"; fast_pattern; distance:-14; within:14; sid:10120966; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iminecraft.se in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iminecraft.se"; fast_pattern; distance:-14; within:14; sid:10120967; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oo.fi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".oo.fi"; fast_pattern; distance:-6; within:6; sid:10120968; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oo.fi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".oo.fi"; fast_pattern; distance:-6; within:6; sid:10120969; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain javafaq.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".javafaq.nu"; fast_pattern; distance:-11; within:11; sid:10120970; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain javafaq.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".javafaq.nu"; fast_pattern; distance:-11; within:11; sid:10120971; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bestforever.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bestforever.com"; fast_pattern; distance:-16; within:16; sid:10120972; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bestforever.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bestforever.com"; fast_pattern; distance:-16; within:16; sid:10120973; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain antongorbunov.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".antongorbunov.com"; fast_pattern; distance:-18; within:18; sid:10120974; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain antongorbunov.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".antongorbunov.com"; fast_pattern; distance:-18; within:18; sid:10120975; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agropeople.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".agropeople.ru"; fast_pattern; distance:-14; within:14; sid:10120976; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agropeople.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".agropeople.ru"; fast_pattern; distance:-14; within:14; sid:10120977; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psp-moscow.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".psp-moscow.com"; fast_pattern; distance:-15; within:15; sid:10120978; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psp-moscow.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".psp-moscow.com"; fast_pattern; distance:-15; within:15; sid:10120979; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crackedsidewalks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".crackedsidewalks.com"; fast_pattern; distance:-21; within:21; sid:10120980; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crackedsidewalks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".crackedsidewalks.com"; fast_pattern; distance:-21; within:21; sid:10120981; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain eye.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".eye.rs"; fast_pattern; distance:-7; within:7; sid:10120982; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain eye.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".eye.rs"; fast_pattern; distance:-7; within:7; sid:10120983; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain silksky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".silksky.com"; fast_pattern; distance:-12; within:12; sid:10120984; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain silksky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".silksky.com"; fast_pattern; distance:-12; within:12; sid:10120985; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain drunkensailor.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".drunkensailor.org"; fast_pattern; distance:-18; within:18; sid:10120986; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain drunkensailor.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".drunkensailor.org"; fast_pattern; distance:-18; within:18; sid:10120987; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stfu-kthx.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stfu-kthx.net"; fast_pattern; distance:-14; within:14; sid:10120988; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stfu-kthx.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stfu-kthx.net"; fast_pattern; distance:-14; within:14; sid:10120989; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fol.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fol.cl"; fast_pattern; distance:-7; within:7; sid:10120990; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fol.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fol.cl"; fast_pattern; distance:-7; within:7; sid:10120991; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain baltijalv.lv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".baltijalv.lv"; fast_pattern; distance:-13; within:13; sid:10120992; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain baltijalv.lv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".baltijalv.lv"; fast_pattern; distance:-13; within:13; sid:10120993; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bad.mn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bad.mn"; fast_pattern; distance:-7; within:7; sid:10120994; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bad.mn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bad.mn"; fast_pattern; distance:-7; within:7; sid:10120995; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hpc.tw"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hpc.tw"; fast_pattern; distance:-7; within:7; sid:10120996; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hpc.tw in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hpc.tw"; fast_pattern; distance:-7; within:7; sid:10120997; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nard.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nard.ca"; fast_pattern; distance:-8; within:8; sid:10120998; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nard.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nard.ca"; fast_pattern; distance:-8; within:8; sid:10120999; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain coalnet.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".coalnet.ru"; fast_pattern; distance:-11; within:11; sid:10121000; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain coalnet.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".coalnet.ru"; fast_pattern; distance:-11; within:11; sid:10121001; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bagus.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bagus.org"; fast_pattern; distance:-10; within:10; sid:10121002; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bagus.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bagus.org"; fast_pattern; distance:-10; within:10; sid:10121003; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain xpresit.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xpresit.net"; fast_pattern; distance:-12; within:12; sid:10121004; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain xpresit.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xpresit.net"; fast_pattern; distance:-12; within:12; sid:10121005; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zvezdaringa.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zvezdaringa.ru"; fast_pattern; distance:-15; within:15; sid:10121006; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zvezdaringa.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zvezdaringa.ru"; fast_pattern; distance:-15; within:15; sid:10121007; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain colegiotamandare.g12.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".colegiotamandare.g12.br"; fast_pattern; distance:-24; within:24; sid:10121008; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain colegiotamandare.g12.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".colegiotamandare.g12.br"; fast_pattern; distance:-24; within:24; sid:10121009; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain holylandshop.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".holylandshop.ru"; fast_pattern; distance:-16; within:16; sid:10121010; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain holylandshop.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".holylandshop.ru"; fast_pattern; distance:-16; within:16; sid:10121011; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain homelinuxserver.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinuxserver.org"; fast_pattern; distance:-20; within:20; sid:10121012; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain homelinuxserver.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinuxserver.org"; fast_pattern; distance:-20; within:20; sid:10121013; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain violates.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".violates.us"; fast_pattern; distance:-12; within:12; sid:10121014; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain violates.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".violates.us"; fast_pattern; distance:-12; within:12; sid:10121015; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain starkom.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".starkom.ru"; fast_pattern; distance:-11; within:11; sid:10121016; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain starkom.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".starkom.ru"; fast_pattern; distance:-11; within:11; sid:10121017; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pntl.tl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pntl.tl"; fast_pattern; distance:-8; within:8; sid:10121018; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pntl.tl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pntl.tl"; fast_pattern; distance:-8; within:8; sid:10121019; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dearabba.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dearabba.org"; fast_pattern; distance:-13; within:13; sid:10121020; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dearabba.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dearabba.org"; fast_pattern; distance:-13; within:13; sid:10121021; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain airlinemeals.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".airlinemeals.net"; fast_pattern; distance:-17; within:17; sid:10121022; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain airlinemeals.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".airlinemeals.net"; fast_pattern; distance:-17; within:17; sid:10121023; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zonet.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zonet.us"; fast_pattern; distance:-9; within:9; sid:10121024; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zonet.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zonet.us"; fast_pattern; distance:-9; within:9; sid:10121025; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain malam.or.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".malam.or.id"; fast_pattern; distance:-12; within:12; sid:10121026; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain malam.or.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".malam.or.id"; fast_pattern; distance:-12; within:12; sid:10121027; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sektori.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sektori.org"; fast_pattern; distance:-12; within:12; sid:10121028; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sektori.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sektori.org"; fast_pattern; distance:-12; within:12; sid:10121029; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain freesa.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".freesa.org"; fast_pattern; distance:-11; within:11; sid:10121030; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain freesa.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".freesa.org"; fast_pattern; distance:-11; within:11; sid:10121031; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mindhackers.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mindhackers.org"; fast_pattern; distance:-16; within:16; sid:10121032; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mindhackers.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mindhackers.org"; fast_pattern; distance:-16; within:16; sid:10121033; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain play.ai"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".play.ai"; fast_pattern; distance:-8; within:8; sid:10121034; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain play.ai in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".play.ai"; fast_pattern; distance:-8; within:8; sid:10121035; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qq.my"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qq.my"; fast_pattern; distance:-6; within:6; sid:10121036; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qq.my in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qq.my"; fast_pattern; distance:-6; within:6; sid:10121037; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain joiavip.com.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".joiavip.com.br"; fast_pattern; distance:-15; within:15; sid:10121038; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain joiavip.com.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".joiavip.com.br"; fast_pattern; distance:-15; within:15; sid:10121039; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vivat-consult.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vivat-consult.ru"; fast_pattern; distance:-17; within:17; sid:10121040; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vivat-consult.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vivat-consult.ru"; fast_pattern; distance:-17; within:17; sid:10121041; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oganilirkab.go.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".oganilirkab.go.id"; fast_pattern; distance:-18; within:18; sid:10121042; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oganilirkab.go.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".oganilirkab.go.id"; fast_pattern; distance:-18; within:18; sid:10121043; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kopi.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kopi.co.id"; fast_pattern; distance:-11; within:11; sid:10121044; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kopi.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kopi.co.id"; fast_pattern; distance:-11; within:11; sid:10121045; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain medicost.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".medicost.org"; fast_pattern; distance:-13; within:13; sid:10121046; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain medicost.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".medicost.org"; fast_pattern; distance:-13; within:13; sid:10121047; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain i-t.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".i-t.me"; fast_pattern; distance:-7; within:7; sid:10121048; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain i-t.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".i-t.me"; fast_pattern; distance:-7; within:7; sid:10121049; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain routemehome.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".routemehome.com"; fast_pattern; distance:-16; within:16; sid:10121050; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain routemehome.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".routemehome.com"; fast_pattern; distance:-16; within:16; sid:10121051; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain good.one.pl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".good.one.pl"; fast_pattern; distance:-12; within:12; sid:10121052; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain good.one.pl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".good.one.pl"; fast_pattern; distance:-12; within:12; sid:10121053; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain playop.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".playop.net"; fast_pattern; distance:-11; within:11; sid:10121054; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain playop.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".playop.net"; fast_pattern; distance:-11; within:11; sid:10121055; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain all.my"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".all.my"; fast_pattern; distance:-7; within:7; sid:10121056; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain all.my in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".all.my"; fast_pattern; distance:-7; within:7; sid:10121057; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain possessed.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".possessed.us"; fast_pattern; distance:-13; within:13; sid:10121058; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain possessed.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".possessed.us"; fast_pattern; distance:-13; within:13; sid:10121059; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nav.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nav.co.id"; fast_pattern; distance:-10; within:10; sid:10121060; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nav.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nav.co.id"; fast_pattern; distance:-10; within:10; sid:10121061; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain surfnet.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".surfnet.ca"; fast_pattern; distance:-11; within:11; sid:10121062; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain surfnet.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".surfnet.ca"; fast_pattern; distance:-11; within:11; sid:10121063; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain awiki.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".awiki.org"; fast_pattern; distance:-10; within:10; sid:10121064; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain awiki.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".awiki.org"; fast_pattern; distance:-10; within:10; sid:10121065; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fairuse.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fairuse.org"; fast_pattern; distance:-12; within:12; sid:10121066; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fairuse.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fairuse.org"; fast_pattern; distance:-12; within:12; sid:10121067; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pce-cihazlari.com.tr"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pce-cihazlari.com.tr"; fast_pattern; distance:-21; within:21; sid:10121068; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pce-cihazlari.com.tr in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pce-cihazlari.com.tr"; fast_pattern; distance:-21; within:21; sid:10121069; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain violates.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".violates.me"; fast_pattern; distance:-12; within:12; sid:10121070; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain violates.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".violates.me"; fast_pattern; distance:-12; within:12; sid:10121071; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain amurt.org.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".amurt.org.uk"; fast_pattern; distance:-13; within:13; sid:10121072; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain amurt.org.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".amurt.org.uk"; fast_pattern; distance:-13; within:13; sid:10121073; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 3n.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3n.cc"; fast_pattern; distance:-6; within:6; sid:10121074; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 3n.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3n.cc"; fast_pattern; distance:-6; within:6; sid:10121075; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain asenov.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".asenov.ru"; fast_pattern; distance:-10; within:10; sid:10121076; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain asenov.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".asenov.ru"; fast_pattern; distance:-10; within:10; sid:10121077; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain funkar.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".funkar.nu"; fast_pattern; distance:-10; within:10; sid:10121078; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain funkar.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".funkar.nu"; fast_pattern; distance:-10; within:10; sid:10121079; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hs.vc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hs.vc"; fast_pattern; distance:-6; within:6; sid:10121080; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hs.vc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hs.vc"; fast_pattern; distance:-6; within:6; sid:10121081; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain allisons.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".allisons.org"; fast_pattern; distance:-13; within:13; sid:10121082; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain allisons.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".allisons.org"; fast_pattern; distance:-13; within:13; sid:10121083; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain empresastaylor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".empresastaylor.com"; fast_pattern; distance:-19; within:19; sid:10121084; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain empresastaylor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".empresastaylor.com"; fast_pattern; distance:-19; within:19; sid:10121085; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain giveawaylisting.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".giveawaylisting.com"; fast_pattern; distance:-20; within:20; sid:10121086; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain giveawaylisting.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".giveawaylisting.com"; fast_pattern; distance:-20; within:20; sid:10121087; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain novgaz-rzn.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".novgaz-rzn.ru"; fast_pattern; distance:-14; within:14; sid:10121088; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain novgaz-rzn.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".novgaz-rzn.ru"; fast_pattern; distance:-14; within:14; sid:10121089; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fatdiary.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fatdiary.org"; fast_pattern; distance:-13; within:13; sid:10121090; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fatdiary.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fatdiary.org"; fast_pattern; distance:-13; within:13; sid:10121091; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain india.sh"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".india.sh"; fast_pattern; distance:-9; within:9; sid:10121092; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain india.sh in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".india.sh"; fast_pattern; distance:-9; within:9; sid:10121093; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oneindonesia.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".oneindonesia.co.id"; fast_pattern; distance:-19; within:19; sid:10121094; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oneindonesia.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".oneindonesia.co.id"; fast_pattern; distance:-19; within:19; sid:10121095; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mikata.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mikata.ru"; fast_pattern; distance:-10; within:10; sid:10121096; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mikata.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mikata.ru"; fast_pattern; distance:-10; within:10; sid:10121097; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain n-e-t.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".n-e-t.name"; fast_pattern; distance:-11; within:11; sid:10121098; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain n-e-t.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".n-e-t.name"; fast_pattern; distance:-11; within:11; sid:10121099; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain host2go.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".host2go.net"; fast_pattern; distance:-12; within:12; sid:10121100; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain host2go.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".host2go.net"; fast_pattern; distance:-12; within:12; sid:10121101; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hiddencorner.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hiddencorner.org"; fast_pattern; distance:-17; within:17; sid:10121102; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hiddencorner.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hiddencorner.org"; fast_pattern; distance:-17; within:17; sid:10121103; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zsh.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zsh.jp"; fast_pattern; distance:-7; within:7; sid:10121104; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zsh.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zsh.jp"; fast_pattern; distance:-7; within:7; sid:10121105; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain inflict.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".inflict.us"; fast_pattern; distance:-11; within:11; sid:10121106; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain inflict.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".inflict.us"; fast_pattern; distance:-11; within:11; sid:10121107; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain quannhacvang.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".quannhacvang.com"; fast_pattern; distance:-17; within:17; sid:10121108; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain quannhacvang.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".quannhacvang.com"; fast_pattern; distance:-17; within:17; sid:10121109; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dhm.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dhm.ro"; fast_pattern; distance:-7; within:7; sid:10121110; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dhm.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dhm.ro"; fast_pattern; distance:-7; within:7; sid:10121111; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain maluwilz.lv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".maluwilz.lv"; fast_pattern; distance:-12; within:12; sid:10121112; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain maluwilz.lv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".maluwilz.lv"; fast_pattern; distance:-12; within:12; sid:10121113; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain remoteaccess.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".remoteaccess.me"; fast_pattern; distance:-16; within:16; sid:10121114; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain remoteaccess.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".remoteaccess.me"; fast_pattern; distance:-16; within:16; sid:10121115; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vankin.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vankin.de"; fast_pattern; distance:-10; within:10; sid:10121116; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vankin.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vankin.de"; fast_pattern; distance:-10; within:10; sid:10121117; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain raspberryip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".raspberryip.com"; fast_pattern; distance:-16; within:16; sid:10121118; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain raspberryip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".raspberryip.com"; fast_pattern; distance:-16; within:16; sid:10121119; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain krash.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".krash.net"; fast_pattern; distance:-10; within:10; sid:10121120; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain krash.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".krash.net"; fast_pattern; distance:-10; within:10; sid:10121121; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain z86.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".z86.ru"; fast_pattern; distance:-7; within:7; sid:10121122; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain z86.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".z86.ru"; fast_pattern; distance:-7; within:7; sid:10121123; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain erki.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".erki.net"; fast_pattern; distance:-9; within:9; sid:10121124; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain erki.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".erki.net"; fast_pattern; distance:-9; within:9; sid:10121125; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain joe.dj"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".joe.dj"; fast_pattern; distance:-7; within:7; sid:10121126; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain joe.dj in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".joe.dj"; fast_pattern; distance:-7; within:7; sid:10121127; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tacowolf.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tacowolf.com"; fast_pattern; distance:-13; within:13; sid:10121128; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tacowolf.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tacowolf.com"; fast_pattern; distance:-13; within:13; sid:10121129; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cpia.org.ar"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cpia.org.ar"; fast_pattern; distance:-12; within:12; sid:10121130; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cpia.org.ar in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cpia.org.ar"; fast_pattern; distance:-12; within:12; sid:10121131; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain netlord.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".netlord.de"; fast_pattern; distance:-11; within:11; sid:10121132; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain netlord.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".netlord.de"; fast_pattern; distance:-11; within:11; sid:10121133; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cnstefancelmare.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cnstefancelmare.ro"; fast_pattern; distance:-19; within:19; sid:10121134; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cnstefancelmare.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cnstefancelmare.ro"; fast_pattern; distance:-19; within:19; sid:10121135; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hmao.pro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hmao.pro"; fast_pattern; distance:-9; within:9; sid:10121136; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hmao.pro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hmao.pro"; fast_pattern; distance:-9; within:9; sid:10121137; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain php-dev.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".php-dev.net"; fast_pattern; distance:-12; within:12; sid:10121138; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain php-dev.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".php-dev.net"; fast_pattern; distance:-12; within:12; sid:10121139; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain webs.vc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webs.vc"; fast_pattern; distance:-8; within:8; sid:10121140; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain webs.vc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webs.vc"; fast_pattern; distance:-8; within:8; sid:10121141; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bobcentury.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bobcentury.com"; fast_pattern; distance:-15; within:15; sid:10121142; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bobcentury.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bobcentury.com"; fast_pattern; distance:-15; within:15; sid:10121143; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain computersforpeace.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".computersforpeace.net"; fast_pattern; distance:-22; within:22; sid:10121144; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain computersforpeace.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".computersforpeace.net"; fast_pattern; distance:-22; within:22; sid:10121145; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 688.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".688.org"; fast_pattern; distance:-8; within:8; sid:10121146; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 688.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".688.org"; fast_pattern; distance:-8; within:8; sid:10121147; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain richlorenz.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".richlorenz.com"; fast_pattern; distance:-15; within:15; sid:10121148; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain richlorenz.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".richlorenz.com"; fast_pattern; distance:-15; within:15; sid:10121149; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tzafrir.org.il"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tzafrir.org.il"; fast_pattern; distance:-15; within:15; sid:10121150; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tzafrir.org.il in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tzafrir.org.il"; fast_pattern; distance:-15; within:15; sid:10121151; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain galipan.net.ve"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".galipan.net.ve"; fast_pattern; distance:-15; within:15; sid:10121152; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain galipan.net.ve in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".galipan.net.ve"; fast_pattern; distance:-15; within:15; sid:10121153; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h0stname.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".h0stname.net"; fast_pattern; distance:-13; within:13; sid:10121154; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h0stname.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".h0stname.net"; fast_pattern; distance:-13; within:13; sid:10121155; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ddos.im"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddos.im"; fast_pattern; distance:-8; within:8; sid:10121156; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ddos.im in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddos.im"; fast_pattern; distance:-8; within:8; sid:10121157; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain inedelya.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".inedelya.ru"; fast_pattern; distance:-12; within:12; sid:10121158; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain inedelya.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".inedelya.ru"; fast_pattern; distance:-12; within:12; sid:10121159; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vkagent.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vkagent.ru"; fast_pattern; distance:-11; within:11; sid:10121160; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vkagent.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vkagent.ru"; fast_pattern; distance:-11; within:11; sid:10121161; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cloudwatch.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cloudwatch.net"; fast_pattern; distance:-15; within:15; sid:10121162; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cloudwatch.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cloudwatch.net"; fast_pattern; distance:-15; within:15; sid:10121163; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sdp-mos.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sdp-mos.ru"; fast_pattern; distance:-11; within:11; sid:10121164; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sdp-mos.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sdp-mos.ru"; fast_pattern; distance:-11; within:11; sid:10121165; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain takeshi.cnt.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".takeshi.cnt.br"; fast_pattern; distance:-15; within:15; sid:10121166; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain takeshi.cnt.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".takeshi.cnt.br"; fast_pattern; distance:-15; within:15; sid:10121167; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain floripalondon.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".floripalondon.com"; fast_pattern; distance:-18; within:18; sid:10121168; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain floripalondon.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".floripalondon.com"; fast_pattern; distance:-18; within:18; sid:10121169; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain orenznakomstva.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".orenznakomstva.ru"; fast_pattern; distance:-18; within:18; sid:10121170; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain orenznakomstva.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".orenznakomstva.ru"; fast_pattern; distance:-18; within:18; sid:10121171; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2fine.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".2fine.de"; fast_pattern; distance:-9; within:9; sid:10121172; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2fine.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".2fine.de"; fast_pattern; distance:-9; within:9; sid:10121173; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 4040.idv.tw"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".4040.idv.tw"; fast_pattern; distance:-12; within:12; sid:10121174; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 4040.idv.tw in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".4040.idv.tw"; fast_pattern; distance:-12; within:12; sid:10121175; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain photo-cult.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".photo-cult.com"; fast_pattern; distance:-15; within:15; sid:10121176; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain photo-cult.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".photo-cult.com"; fast_pattern; distance:-15; within:15; sid:10121177; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain winkel.com.ar"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".winkel.com.ar"; fast_pattern; distance:-14; within:14; sid:10121178; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain winkel.com.ar in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".winkel.com.ar"; fast_pattern; distance:-14; within:14; sid:10121179; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain juliacake.com.vn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".juliacake.com.vn"; fast_pattern; distance:-17; within:17; sid:10121180; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain juliacake.com.vn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".juliacake.com.vn"; fast_pattern; distance:-17; within:17; sid:10121181; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain eva.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".eva.hk"; fast_pattern; distance:-7; within:7; sid:10121182; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain eva.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".eva.hk"; fast_pattern; distance:-7; within:7; sid:10121183; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain k22.su"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".k22.su"; fast_pattern; distance:-7; within:7; sid:10121184; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain k22.su in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".k22.su"; fast_pattern; distance:-7; within:7; sid:10121185; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tetuku.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tetuku.com"; fast_pattern; distance:-11; within:11; sid:10121186; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tetuku.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tetuku.com"; fast_pattern; distance:-11; within:11; sid:10121187; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ananda.net.ve"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ananda.net.ve"; fast_pattern; distance:-14; within:14; sid:10121188; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ananda.net.ve in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ananda.net.ve"; fast_pattern; distance:-14; within:14; sid:10121189; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain d-n-s.org.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".d-n-s.org.uk"; fast_pattern; distance:-13; within:13; sid:10121190; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain d-n-s.org.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".d-n-s.org.uk"; fast_pattern; distance:-13; within:13; sid:10121191; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blinklab.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blinklab.com"; fast_pattern; distance:-13; within:13; sid:10121192; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blinklab.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blinklab.com"; fast_pattern; distance:-13; within:13; sid:10121193; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pii.at"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pii.at"; fast_pattern; distance:-7; within:7; sid:10121194; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pii.at in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pii.at"; fast_pattern; distance:-7; within:7; sid:10121195; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-data.com.tr"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e-data.com.tr"; fast_pattern; distance:-14; within:14; sid:10121196; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-data.com.tr in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e-data.com.tr"; fast_pattern; distance:-14; within:14; sid:10121197; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tragazorras.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tragazorras.com"; fast_pattern; distance:-16; within:16; sid:10121198; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tragazorras.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tragazorras.com"; fast_pattern; distance:-16; within:16; sid:10121199; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain golf-club.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".golf-club.ro"; fast_pattern; distance:-13; within:13; sid:10121200; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain golf-club.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".golf-club.ro"; fast_pattern; distance:-13; within:13; sid:10121201; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain savage.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".savage.nu"; fast_pattern; distance:-10; within:10; sid:10121202; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain savage.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".savage.nu"; fast_pattern; distance:-10; within:10; sid:10121203; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain your.my.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".your.my.id"; fast_pattern; distance:-11; within:11; sid:10121204; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain your.my.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".your.my.id"; fast_pattern; distance:-11; within:11; sid:10121205; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nashvillerollergirls.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nashvillerollergirls.com"; fast_pattern; distance:-25; within:25; sid:10121206; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nashvillerollergirls.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nashvillerollergirls.com"; fast_pattern; distance:-25; within:25; sid:10121207; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 49b.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".49b.uk"; fast_pattern; distance:-7; within:7; sid:10121208; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 49b.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".49b.uk"; fast_pattern; distance:-7; within:7; sid:10121209; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stalker.fi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stalker.fi"; fast_pattern; distance:-11; within:11; sid:10121210; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stalker.fi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stalker.fi"; fast_pattern; distance:-11; within:11; sid:10121211; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uzid.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".uzid.com"; fast_pattern; distance:-9; within:9; sid:10121212; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uzid.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".uzid.com"; fast_pattern; distance:-9; within:9; sid:10121213; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain doskapozora.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doskapozora.com"; fast_pattern; distance:-16; within:16; sid:10121214; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain doskapozora.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doskapozora.com"; fast_pattern; distance:-16; within:16; sid:10121215; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bloom.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bloom.us"; fast_pattern; distance:-9; within:9; sid:10121216; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bloom.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bloom.us"; fast_pattern; distance:-9; within:9; sid:10121217; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain smbb.ws"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".smbb.ws"; fast_pattern; distance:-8; within:8; sid:10121218; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain smbb.ws in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".smbb.ws"; fast_pattern; distance:-8; within:8; sid:10121219; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stes.fi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stes.fi"; fast_pattern; distance:-8; within:8; sid:10121220; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stes.fi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stes.fi"; fast_pattern; distance:-8; within:8; sid:10121221; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mysaol.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysaol.com"; fast_pattern; distance:-11; within:11; sid:10121222; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mysaol.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysaol.com"; fast_pattern; distance:-11; within:11; sid:10121223; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tanah-aina.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tanah-aina.com"; fast_pattern; distance:-15; within:15; sid:10121224; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tanah-aina.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tanah-aina.com"; fast_pattern; distance:-15; within:15; sid:10121225; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain wiki.gd"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wiki.gd"; fast_pattern; distance:-8; within:8; sid:10121226; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain wiki.gd in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wiki.gd"; fast_pattern; distance:-8; within:8; sid:10121227; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain celebsplay.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".celebsplay.com"; fast_pattern; distance:-15; within:15; sid:10121228; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain celebsplay.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".celebsplay.com"; fast_pattern; distance:-15; within:15; sid:10121229; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain statescasinos.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".statescasinos.com"; fast_pattern; distance:-18; within:18; sid:10121230; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain statescasinos.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".statescasinos.com"; fast_pattern; distance:-18; within:18; sid:10121231; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stroyexpert.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stroyexpert.org"; fast_pattern; distance:-16; within:16; sid:10121232; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stroyexpert.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stroyexpert.org"; fast_pattern; distance:-16; within:16; sid:10121233; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ruok.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ruok.org"; fast_pattern; distance:-9; within:9; sid:10121234; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ruok.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ruok.org"; fast_pattern; distance:-9; within:9; sid:10121235; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain id.web.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".id.web.id"; fast_pattern; distance:-10; within:10; sid:10121236; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain id.web.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".id.web.id"; fast_pattern; distance:-10; within:10; sid:10121237; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain openoffcampus.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".openoffcampus.com"; fast_pattern; distance:-18; within:18; sid:10121238; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain openoffcampus.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".openoffcampus.com"; fast_pattern; distance:-18; within:18; sid:10121239; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bnpt.go.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bnpt.go.id"; fast_pattern; distance:-11; within:11; sid:10121240; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bnpt.go.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bnpt.go.id"; fast_pattern; distance:-11; within:11; sid:10121241; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain forss.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".forss.to"; fast_pattern; distance:-9; within:9; sid:10121242; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain forss.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".forss.to"; fast_pattern; distance:-9; within:9; sid:10121243; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ixx.io"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ixx.io"; fast_pattern; distance:-7; within:7; sid:10121244; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ixx.io in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ixx.io"; fast_pattern; distance:-7; within:7; sid:10121245; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mcsoft.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mcsoft.org"; fast_pattern; distance:-11; within:11; sid:10121246; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mcsoft.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mcsoft.org"; fast_pattern; distance:-11; within:11; sid:10121247; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain surak.kz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".surak.kz"; fast_pattern; distance:-9; within:9; sid:10121248; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain surak.kz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".surak.kz"; fast_pattern; distance:-9; within:9; sid:10121249; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 0x.no"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".0x.no"; fast_pattern; distance:-6; within:6; sid:10121250; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 0x.no in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".0x.no"; fast_pattern; distance:-6; within:6; sid:10121251; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain makny.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".makny.us"; fast_pattern; distance:-9; within:9; sid:10121252; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain makny.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".makny.us"; fast_pattern; distance:-9; within:9; sid:10121253; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain whyboner.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".whyboner.com"; fast_pattern; distance:-13; within:13; sid:10121254; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain whyboner.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".whyboner.com"; fast_pattern; distance:-13; within:13; sid:10121255; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ask2ask.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ask2ask.com"; fast_pattern; distance:-12; within:12; sid:10121256; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ask2ask.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ask2ask.com"; fast_pattern; distance:-12; within:12; sid:10121257; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain servernux.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servernux.com"; fast_pattern; distance:-14; within:14; sid:10121258; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain servernux.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servernux.com"; fast_pattern; distance:-14; within:14; sid:10121259; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blizzie.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blizzie.net"; fast_pattern; distance:-12; within:12; sid:10121260; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blizzie.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blizzie.net"; fast_pattern; distance:-12; within:12; sid:10121261; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stan.cn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stan.cn"; fast_pattern; distance:-8; within:8; sid:10121262; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stan.cn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stan.cn"; fast_pattern; distance:-8; within:8; sid:10121263; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain l5.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".l5.ca"; fast_pattern; distance:-6; within:6; sid:10121264; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain l5.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".l5.ca"; fast_pattern; distance:-6; within:6; sid:10121265; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain good-newz.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".good-newz.org"; fast_pattern; distance:-14; within:14; sid:10121266; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain good-newz.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".good-newz.org"; fast_pattern; distance:-14; within:14; sid:10121267; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dmtr.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dmtr.ru"; fast_pattern; distance:-8; within:8; sid:10121268; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dmtr.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dmtr.ru"; fast_pattern; distance:-8; within:8; sid:10121269; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain aspserver.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".aspserver.net"; fast_pattern; distance:-14; within:14; sid:10121270; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain aspserver.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".aspserver.net"; fast_pattern; distance:-14; within:14; sid:10121271; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thevaughts.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".thevaughts.net"; fast_pattern; distance:-15; within:15; sid:10121272; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thevaughts.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".thevaughts.net"; fast_pattern; distance:-15; within:15; sid:10121273; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uk.ms"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".uk.ms"; fast_pattern; distance:-6; within:6; sid:10121274; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uk.ms in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".uk.ms"; fast_pattern; distance:-6; within:6; sid:10121275; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain opensrc.mx"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".opensrc.mx"; fast_pattern; distance:-11; within:11; sid:10121276; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain opensrc.mx in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".opensrc.mx"; fast_pattern; distance:-11; within:11; sid:10121277; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dalk.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dalk.ru"; fast_pattern; distance:-8; within:8; sid:10121278; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dalk.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dalk.ru"; fast_pattern; distance:-8; within:8; sid:10121279; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain chebicon.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".chebicon.ru"; fast_pattern; distance:-12; within:12; sid:10121280; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain chebicon.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".chebicon.ru"; fast_pattern; distance:-12; within:12; sid:10121281; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yngling.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".yngling.com"; fast_pattern; distance:-12; within:12; sid:10121282; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yngling.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".yngling.com"; fast_pattern; distance:-12; within:12; sid:10121283; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stocktester.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stocktester.ru"; fast_pattern; distance:-15; within:15; sid:10121284; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stocktester.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stocktester.ru"; fast_pattern; distance:-15; within:15; sid:10121285; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nedvighimost-sochi.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nedvighimost-sochi.ru"; fast_pattern; distance:-22; within:22; sid:10121286; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nedvighimost-sochi.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nedvighimost-sochi.ru"; fast_pattern; distance:-22; within:22; sid:10121287; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2p.fm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".2p.fm"; fast_pattern; distance:-6; within:6; sid:10121288; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2p.fm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".2p.fm"; fast_pattern; distance:-6; within:6; sid:10121289; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain americajhon.com.pe"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".americajhon.com.pe"; fast_pattern; distance:-19; within:19; sid:10121290; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain americajhon.com.pe in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".americajhon.com.pe"; fast_pattern; distance:-19; within:19; sid:10121291; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kck-saratov.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kck-saratov.ru"; fast_pattern; distance:-15; within:15; sid:10121292; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kck-saratov.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kck-saratov.ru"; fast_pattern; distance:-15; within:15; sid:10121293; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain piki.si"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".piki.si"; fast_pattern; distance:-8; within:8; sid:10121294; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain piki.si in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".piki.si"; fast_pattern; distance:-8; within:8; sid:10121295; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain benjamin.it"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".benjamin.it"; fast_pattern; distance:-12; within:12; sid:10121296; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain benjamin.it in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".benjamin.it"; fast_pattern; distance:-12; within:12; sid:10121297; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 4twenty.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".4twenty.us"; fast_pattern; distance:-11; within:11; sid:10121298; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 4twenty.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".4twenty.us"; fast_pattern; distance:-11; within:11; sid:10121299; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain erke.biz.tr"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".erke.biz.tr"; fast_pattern; distance:-12; within:12; sid:10121300; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain erke.biz.tr in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".erke.biz.tr"; fast_pattern; distance:-12; within:12; sid:10121301; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sextube.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sextube.ro"; fast_pattern; distance:-11; within:11; sid:10121302; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sextube.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sextube.ro"; fast_pattern; distance:-11; within:11; sid:10121303; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ddanciu.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddanciu.ro"; fast_pattern; distance:-11; within:11; sid:10121304; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ddanciu.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddanciu.ro"; fast_pattern; distance:-11; within:11; sid:10121305; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lex.mn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lex.mn"; fast_pattern; distance:-7; within:7; sid:10121306; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lex.mn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lex.mn"; fast_pattern; distance:-7; within:7; sid:10121307; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mychild.ug"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mychild.ug"; fast_pattern; distance:-11; within:11; sid:10121308; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mychild.ug in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mychild.ug"; fast_pattern; distance:-11; within:11; sid:10121309; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain megamovs.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".megamovs.com"; fast_pattern; distance:-13; within:13; sid:10121310; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain megamovs.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".megamovs.com"; fast_pattern; distance:-13; within:13; sid:10121311; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain custom-gaming.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".custom-gaming.net"; fast_pattern; distance:-18; within:18; sid:10121312; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain custom-gaming.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".custom-gaming.net"; fast_pattern; distance:-18; within:18; sid:10121313; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cda.md"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cda.md"; fast_pattern; distance:-7; within:7; sid:10121314; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cda.md in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cda.md"; fast_pattern; distance:-7; within:7; sid:10121315; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rbb.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rbb.org"; fast_pattern; distance:-8; within:8; sid:10121316; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rbb.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rbb.org"; fast_pattern; distance:-8; within:8; sid:10121317; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sumibi.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sumibi.org"; fast_pattern; distance:-11; within:11; sid:10121318; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sumibi.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sumibi.org"; fast_pattern; distance:-11; within:11; sid:10121319; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hmail.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hmail.us"; fast_pattern; distance:-9; within:9; sid:10121320; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hmail.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hmail.us"; fast_pattern; distance:-9; within:9; sid:10121321; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ipv6.la"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ipv6.la"; fast_pattern; distance:-8; within:8; sid:10121322; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ipv6.la in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ipv6.la"; fast_pattern; distance:-8; within:8; sid:10121323; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thegmc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".thegmc.com"; fast_pattern; distance:-11; within:11; sid:10121324; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thegmc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".thegmc.com"; fast_pattern; distance:-11; within:11; sid:10121325; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ig42.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ig42.org"; fast_pattern; distance:-9; within:9; sid:10121326; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ig42.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ig42.org"; fast_pattern; distance:-9; within:9; sid:10121327; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain anonymous.lv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".anonymous.lv"; fast_pattern; distance:-13; within:13; sid:10121328; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain anonymous.lv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".anonymous.lv"; fast_pattern; distance:-13; within:13; sid:10121329; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dagz.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dagz.ru"; fast_pattern; distance:-8; within:8; sid:10121330; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dagz.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dagz.ru"; fast_pattern; distance:-8; within:8; sid:10121331; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain istanbulsafak.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".istanbulsafak.com"; fast_pattern; distance:-18; within:18; sid:10121332; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain istanbulsafak.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".istanbulsafak.com"; fast_pattern; distance:-18; within:18; sid:10121333; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ormy.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ormy.ru"; fast_pattern; distance:-8; within:8; sid:10121334; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ormy.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ormy.ru"; fast_pattern; distance:-8; within:8; sid:10121335; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ganino.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ganino.com"; fast_pattern; distance:-11; within:11; sid:10121336; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ganino.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ganino.com"; fast_pattern; distance:-11; within:11; sid:10121337; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cw03.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cw03.ru"; fast_pattern; distance:-8; within:8; sid:10121338; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cw03.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cw03.ru"; fast_pattern; distance:-8; within:8; sid:10121339; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lovethosetrains.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lovethosetrains.com"; fast_pattern; distance:-20; within:20; sid:10121340; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lovethosetrains.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lovethosetrains.com"; fast_pattern; distance:-20; within:20; sid:10121341; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qualirede.com.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qualirede.com.br"; fast_pattern; distance:-17; within:17; sid:10121342; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qualirede.com.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qualirede.com.br"; fast_pattern; distance:-17; within:17; sid:10121343; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain xxxxx.tw"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xxxxx.tw"; fast_pattern; distance:-9; within:9; sid:10121344; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain xxxxx.tw in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xxxxx.tw"; fast_pattern; distance:-9; within:9; sid:10121345; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain optimas.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".optimas.co.id"; fast_pattern; distance:-14; within:14; sid:10121346; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain optimas.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".optimas.co.id"; fast_pattern; distance:-14; within:14; sid:10121347; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dyn.ch"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyn.ch"; fast_pattern; distance:-7; within:7; sid:10121348; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dyn.ch in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyn.ch"; fast_pattern; distance:-7; within:7; sid:10121349; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oldrussianmagic.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".oldrussianmagic.com"; fast_pattern; distance:-20; within:20; sid:10121350; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oldrussianmagic.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".oldrussianmagic.com"; fast_pattern; distance:-20; within:20; sid:10121351; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hbmc.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hbmc.net"; fast_pattern; distance:-9; within:9; sid:10121352; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hbmc.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hbmc.net"; fast_pattern; distance:-9; within:9; sid:10121353; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cys.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cys.ru"; fast_pattern; distance:-7; within:7; sid:10121354; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cys.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cys.ru"; fast_pattern; distance:-7; within:7; sid:10121355; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kyrgyzstan.kg"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kyrgyzstan.kg"; fast_pattern; distance:-14; within:14; sid:10121356; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kyrgyzstan.kg in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kyrgyzstan.kg"; fast_pattern; distance:-14; within:14; sid:10121357; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nevalain.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nevalain.ru"; fast_pattern; distance:-12; within:12; sid:10121358; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nevalain.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nevalain.ru"; fast_pattern; distance:-12; within:12; sid:10121359; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain philipkingsleyshop.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".philipkingsleyshop.ru"; fast_pattern; distance:-22; within:22; sid:10121360; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain philipkingsleyshop.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".philipkingsleyshop.ru"; fast_pattern; distance:-22; within:22; sid:10121361; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain darknigger.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".darknigger.com"; fast_pattern; distance:-15; within:15; sid:10121362; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain darknigger.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".darknigger.com"; fast_pattern; distance:-15; within:15; sid:10121363; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sne.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sne.jp"; fast_pattern; distance:-7; within:7; sid:10121364; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sne.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sne.jp"; fast_pattern; distance:-7; within:7; sid:10121365; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dob.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dob.jp"; fast_pattern; distance:-7; within:7; sid:10121366; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dob.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dob.jp"; fast_pattern; distance:-7; within:7; sid:10121367; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ghostnation.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ghostnation.org"; fast_pattern; distance:-16; within:16; sid:10121368; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ghostnation.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ghostnation.org"; fast_pattern; distance:-16; within:16; sid:10121369; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain beerprojects.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".beerprojects.com"; fast_pattern; distance:-17; within:17; sid:10121370; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain beerprojects.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".beerprojects.com"; fast_pattern; distance:-17; within:17; sid:10121371; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain womenclothingtoday.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".womenclothingtoday.com"; fast_pattern; distance:-23; within:23; sid:10121372; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain womenclothingtoday.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".womenclothingtoday.com"; fast_pattern; distance:-23; within:23; sid:10121373; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iceblaze.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iceblaze.com"; fast_pattern; distance:-13; within:13; sid:10121374; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iceblaze.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iceblaze.com"; fast_pattern; distance:-13; within:13; sid:10121375; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iu4ever.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iu4ever.org"; fast_pattern; distance:-12; within:12; sid:10121376; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iu4ever.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iu4ever.org"; fast_pattern; distance:-12; within:12; sid:10121377; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rixtour.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rixtour.com"; fast_pattern; distance:-12; within:12; sid:10121378; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rixtour.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rixtour.com"; fast_pattern; distance:-12; within:12; sid:10121379; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain topdanang.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".topdanang.com"; fast_pattern; distance:-14; within:14; sid:10121380; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain topdanang.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".topdanang.com"; fast_pattern; distance:-14; within:14; sid:10121381; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ezxdev.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ezxdev.org"; fast_pattern; distance:-11; within:11; sid:10121382; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ezxdev.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ezxdev.org"; fast_pattern; distance:-11; within:11; sid:10121383; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain heroinewarrior.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".heroinewarrior.com"; fast_pattern; distance:-19; within:19; sid:10121384; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain heroinewarrior.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".heroinewarrior.com"; fast_pattern; distance:-19; within:19; sid:10121385; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain grpn.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".grpn.ru"; fast_pattern; distance:-8; within:8; sid:10121386; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain grpn.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".grpn.ru"; fast_pattern; distance:-8; within:8; sid:10121387; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain elchemi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".elchemi.com"; fast_pattern; distance:-12; within:12; sid:10121388; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain elchemi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".elchemi.com"; fast_pattern; distance:-12; within:12; sid:10121389; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain musterihizmetleri.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".musterihizmetleri.com"; fast_pattern; distance:-22; within:22; sid:10121390; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain musterihizmetleri.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".musterihizmetleri.com"; fast_pattern; distance:-22; within:22; sid:10121391; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain playfv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".playfv.com"; fast_pattern; distance:-11; within:11; sid:10121392; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain playfv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".playfv.com"; fast_pattern; distance:-11; within:11; sid:10121393; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ccmissoula.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ccmissoula.com"; fast_pattern; distance:-15; within:15; sid:10121394; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ccmissoula.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ccmissoula.com"; fast_pattern; distance:-15; within:15; sid:10121395; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blogs.or.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogs.or.id"; fast_pattern; distance:-12; within:12; sid:10121396; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blogs.or.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogs.or.id"; fast_pattern; distance:-12; within:12; sid:10121397; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e.co.za"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e.co.za"; fast_pattern; distance:-8; within:8; sid:10121398; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e.co.za in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e.co.za"; fast_pattern; distance:-8; within:8; sid:10121399; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zhilcontrol.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zhilcontrol.ru"; fast_pattern; distance:-15; within:15; sid:10121400; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zhilcontrol.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zhilcontrol.ru"; fast_pattern; distance:-15; within:15; sid:10121401; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ns22.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns22.ru"; fast_pattern; distance:-8; within:8; sid:10121402; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ns22.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns22.ru"; fast_pattern; distance:-8; within:8; sid:10121403; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qlbv.vn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qlbv.vn"; fast_pattern; distance:-8; within:8; sid:10121404; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qlbv.vn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qlbv.vn"; fast_pattern; distance:-8; within:8; sid:10121405; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain prostore.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".prostore.ru"; fast_pattern; distance:-12; within:12; sid:10121406; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain prostore.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".prostore.ru"; fast_pattern; distance:-12; within:12; sid:10121407; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain divakeramika.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".divakeramika.com"; fast_pattern; distance:-17; within:17; sid:10121408; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain divakeramika.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".divakeramika.com"; fast_pattern; distance:-17; within:17; sid:10121409; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sweetriders.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sweetriders.com"; fast_pattern; distance:-16; within:16; sid:10121410; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sweetriders.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sweetriders.com"; fast_pattern; distance:-16; within:16; sid:10121411; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain make.com.ar"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".make.com.ar"; fast_pattern; distance:-12; within:12; sid:10121412; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain make.com.ar in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".make.com.ar"; fast_pattern; distance:-12; within:12; sid:10121413; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain smelly.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".smelly.cc"; fast_pattern; distance:-10; within:10; sid:10121414; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain smelly.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".smelly.cc"; fast_pattern; distance:-10; within:10; sid:10121415; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain b33r.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".b33r.us"; fast_pattern; distance:-8; within:8; sid:10121416; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain b33r.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".b33r.us"; fast_pattern; distance:-8; within:8; sid:10121417; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gerastar.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gerastar.ru"; fast_pattern; distance:-12; within:12; sid:10121418; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gerastar.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gerastar.ru"; fast_pattern; distance:-12; within:12; sid:10121419; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tvlinux.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tvlinux.com"; fast_pattern; distance:-12; within:12; sid:10121420; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tvlinux.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tvlinux.com"; fast_pattern; distance:-12; within:12; sid:10121421; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain linux70.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".linux70.ru"; fast_pattern; distance:-11; within:11; sid:10121422; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain linux70.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".linux70.ru"; fast_pattern; distance:-11; within:11; sid:10121423; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dellsale.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dellsale.ru"; fast_pattern; distance:-12; within:12; sid:10121424; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dellsale.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dellsale.ru"; fast_pattern; distance:-12; within:12; sid:10121425; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lolk.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lolk.org"; fast_pattern; distance:-9; within:9; sid:10121426; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lolk.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lolk.org"; fast_pattern; distance:-9; within:9; sid:10121427; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain priamaakcia.sk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".priamaakcia.sk"; fast_pattern; distance:-15; within:15; sid:10121428; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain priamaakcia.sk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".priamaakcia.sk"; fast_pattern; distance:-15; within:15; sid:10121429; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain aintno.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".aintno.info"; fast_pattern; distance:-12; within:12; sid:10121430; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain aintno.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".aintno.info"; fast_pattern; distance:-12; within:12; sid:10121431; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jcor.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jcor.ca"; fast_pattern; distance:-8; within:8; sid:10121432; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jcor.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jcor.ca"; fast_pattern; distance:-8; within:8; sid:10121433; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kein.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kein.hk"; fast_pattern; distance:-8; within:8; sid:10121434; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kein.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kein.hk"; fast_pattern; distance:-8; within:8; sid:10121435; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain procare.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".procare.co.id"; fast_pattern; distance:-14; within:14; sid:10121436; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain procare.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".procare.co.id"; fast_pattern; distance:-14; within:14; sid:10121437; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tv-l.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tv-l.ru"; fast_pattern; distance:-8; within:8; sid:10121438; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tv-l.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tv-l.ru"; fast_pattern; distance:-8; within:8; sid:10121439; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain diipl.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".diipl.com"; fast_pattern; distance:-10; within:10; sid:10121440; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain diipl.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".diipl.com"; fast_pattern; distance:-10; within:10; sid:10121441; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain null.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".null.rs"; fast_pattern; distance:-8; within:8; sid:10121442; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain null.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".null.rs"; fast_pattern; distance:-8; within:8; sid:10121443; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain reason.org.nz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".reason.org.nz"; fast_pattern; distance:-14; within:14; sid:10121444; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain reason.org.nz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".reason.org.nz"; fast_pattern; distance:-14; within:14; sid:10121445; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyminecraft.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".happyminecraft.com"; fast_pattern; distance:-19; within:19; sid:10121446; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyminecraft.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".happyminecraft.com"; fast_pattern; distance:-19; within:19; sid:10121447; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain plnntt.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".plnntt.co.id"; fast_pattern; distance:-13; within:13; sid:10121448; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain plnntt.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".plnntt.co.id"; fast_pattern; distance:-13; within:13; sid:10121449; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain everton.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".everton.com"; fast_pattern; distance:-12; within:12; sid:10121450; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain everton.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".everton.com"; fast_pattern; distance:-12; within:12; sid:10121451; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gurcanozturk.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gurcanozturk.com"; fast_pattern; distance:-17; within:17; sid:10121452; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gurcanozturk.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gurcanozturk.com"; fast_pattern; distance:-17; within:17; sid:10121453; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jpfiles.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jpfiles.eu"; fast_pattern; distance:-11; within:11; sid:10121454; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jpfiles.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jpfiles.eu"; fast_pattern; distance:-11; within:11; sid:10121455; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kiani.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kiani.com"; fast_pattern; distance:-10; within:10; sid:10121456; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kiani.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kiani.com"; fast_pattern; distance:-10; within:10; sid:10121457; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain caturelang.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".caturelang.co.id"; fast_pattern; distance:-17; within:17; sid:10121458; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain caturelang.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".caturelang.co.id"; fast_pattern; distance:-17; within:17; sid:10121459; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pckf.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pckf.com"; fast_pattern; distance:-9; within:9; sid:10121460; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pckf.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pckf.com"; fast_pattern; distance:-9; within:9; sid:10121461; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain trumgame.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".trumgame.net"; fast_pattern; distance:-13; within:13; sid:10121462; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain trumgame.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".trumgame.net"; fast_pattern; distance:-13; within:13; sid:10121463; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain brawlcustommusic.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".brawlcustommusic.com"; fast_pattern; distance:-21; within:21; sid:10121464; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain brawlcustommusic.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".brawlcustommusic.com"; fast_pattern; distance:-21; within:21; sid:10121465; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dnet.hu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnet.hu"; fast_pattern; distance:-8; within:8; sid:10121466; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dnet.hu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnet.hu"; fast_pattern; distance:-8; within:8; sid:10121467; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain innograph.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".innograph.co.id"; fast_pattern; distance:-16; within:16; sid:10121468; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain innograph.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".innograph.co.id"; fast_pattern; distance:-16; within:16; sid:10121469; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sith.su"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sith.su"; fast_pattern; distance:-8; within:8; sid:10121470; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sith.su in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sith.su"; fast_pattern; distance:-8; within:8; sid:10121471; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain naru.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".naru.to"; fast_pattern; distance:-8; within:8; sid:10121472; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain naru.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".naru.to"; fast_pattern; distance:-8; within:8; sid:10121473; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 8634.su"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".8634.su"; fast_pattern; distance:-8; within:8; sid:10121474; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 8634.su in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".8634.su"; fast_pattern; distance:-8; within:8; sid:10121475; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ivi.pl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ivi.pl"; fast_pattern; distance:-7; within:7; sid:10121476; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ivi.pl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ivi.pl"; fast_pattern; distance:-7; within:7; sid:10121477; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain polissya.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".polissya.eu"; fast_pattern; distance:-12; within:12; sid:10121478; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain polissya.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".polissya.eu"; fast_pattern; distance:-12; within:12; sid:10121479; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hitremixes.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hitremixes.com"; fast_pattern; distance:-15; within:15; sid:10121480; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hitremixes.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hitremixes.com"; fast_pattern; distance:-15; within:15; sid:10121481; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain m-kopa.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".m-kopa.net"; fast_pattern; distance:-11; within:11; sid:10121482; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain m-kopa.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".m-kopa.net"; fast_pattern; distance:-11; within:11; sid:10121483; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain netmask.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".netmask.ca"; fast_pattern; distance:-11; within:11; sid:10121484; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain netmask.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".netmask.ca"; fast_pattern; distance:-11; within:11; sid:10121485; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain warmkessel.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".warmkessel.com"; fast_pattern; distance:-15; within:15; sid:10121486; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain warmkessel.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".warmkessel.com"; fast_pattern; distance:-15; within:15; sid:10121487; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hayeshelp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hayeshelp.com"; fast_pattern; distance:-14; within:14; sid:10121488; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hayeshelp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hayeshelp.com"; fast_pattern; distance:-14; within:14; sid:10121489; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yourspecialtee.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".yourspecialtee.com"; fast_pattern; distance:-19; within:19; sid:10121490; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yourspecialtee.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".yourspecialtee.com"; fast_pattern; distance:-19; within:19; sid:10121491; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain donkeyhot.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".donkeyhot.net"; fast_pattern; distance:-14; within:14; sid:10121492; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain donkeyhot.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".donkeyhot.net"; fast_pattern; distance:-14; within:14; sid:10121493; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2ku.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".2ku.ru"; fast_pattern; distance:-7; within:7; sid:10121494; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2ku.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".2ku.ru"; fast_pattern; distance:-7; within:7; sid:10121495; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gebish.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gebish.org"; fast_pattern; distance:-11; within:11; sid:10121496; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gebish.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gebish.org"; fast_pattern; distance:-11; within:11; sid:10121497; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain russkoeumea.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".russkoeumea.com"; fast_pattern; distance:-16; within:16; sid:10121498; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain russkoeumea.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".russkoeumea.com"; fast_pattern; distance:-16; within:16; sid:10121499; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain haki.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".haki.hk"; fast_pattern; distance:-8; within:8; sid:10121500; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain haki.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".haki.hk"; fast_pattern; distance:-8; within:8; sid:10121501; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ilkor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ilkor.com"; fast_pattern; distance:-10; within:10; sid:10121502; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ilkor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ilkor.com"; fast_pattern; distance:-10; within:10; sid:10121503; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mett.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mett.ru"; fast_pattern; distance:-8; within:8; sid:10121504; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mett.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mett.ru"; fast_pattern; distance:-8; within:8; sid:10121505; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain orskkino.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".orskkino.ru"; fast_pattern; distance:-12; within:12; sid:10121506; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain orskkino.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".orskkino.ru"; fast_pattern; distance:-12; within:12; sid:10121507; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain swsc.org.np"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".swsc.org.np"; fast_pattern; distance:-12; within:12; sid:10121508; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain swsc.org.np in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".swsc.org.np"; fast_pattern; distance:-12; within:12; sid:10121509; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 150watt.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".150watt.ru"; fast_pattern; distance:-11; within:11; sid:10121510; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 150watt.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".150watt.ru"; fast_pattern; distance:-11; within:11; sid:10121511; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dp76.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dp76.com"; fast_pattern; distance:-9; within:9; sid:10121512; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dp76.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dp76.com"; fast_pattern; distance:-9; within:9; sid:10121513; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gtk.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gtk.cl"; fast_pattern; distance:-7; within:7; sid:10121514; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gtk.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gtk.cl"; fast_pattern; distance:-7; within:7; sid:10121515; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privateimport.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".privateimport.jp"; fast_pattern; distance:-17; within:17; sid:10121516; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privateimport.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".privateimport.jp"; fast_pattern; distance:-17; within:17; sid:10121517; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tedx.ee"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tedx.ee"; fast_pattern; distance:-8; within:8; sid:10121518; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tedx.ee in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tedx.ee"; fast_pattern; distance:-8; within:8; sid:10121519; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tru.io"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tru.io"; fast_pattern; distance:-7; within:7; sid:10121520; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tru.io in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tru.io"; fast_pattern; distance:-7; within:7; sid:10121521; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cc.net.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cc.net.br"; fast_pattern; distance:-10; within:10; sid:10121522; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cc.net.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cc.net.br"; fast_pattern; distance:-10; within:10; sid:10121523; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lanas.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lanas.cl"; fast_pattern; distance:-9; within:9; sid:10121524; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lanas.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lanas.cl"; fast_pattern; distance:-9; within:9; sid:10121525; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ugo.si"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ugo.si"; fast_pattern; distance:-7; within:7; sid:10121526; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ugo.si in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ugo.si"; fast_pattern; distance:-7; within:7; sid:10121527; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain elitter.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".elitter.net"; fast_pattern; distance:-12; within:12; sid:10121528; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain elitter.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".elitter.net"; fast_pattern; distance:-12; within:12; sid:10121529; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evs.net.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".evs.net.br"; fast_pattern; distance:-11; within:11; sid:10121530; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evs.net.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".evs.net.br"; fast_pattern; distance:-11; within:11; sid:10121531; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jundy.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jundy.org"; fast_pattern; distance:-10; within:10; sid:10121532; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jundy.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jundy.org"; fast_pattern; distance:-10; within:10; sid:10121533; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nevskayaratusha.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nevskayaratusha.ru"; fast_pattern; distance:-19; within:19; sid:10121534; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nevskayaratusha.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nevskayaratusha.ru"; fast_pattern; distance:-19; within:19; sid:10121535; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain technopagans.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".technopagans.com"; fast_pattern; distance:-17; within:17; sid:10121536; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain technopagans.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".technopagans.com"; fast_pattern; distance:-17; within:17; sid:10121537; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain asianfreshproduce.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".asianfreshproduce.com"; fast_pattern; distance:-22; within:22; sid:10121538; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain asianfreshproduce.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".asianfreshproduce.com"; fast_pattern; distance:-22; within:22; sid:10121539; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hijaxdesigns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hijaxdesigns.com"; fast_pattern; distance:-17; within:17; sid:10121540; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hijaxdesigns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hijaxdesigns.com"; fast_pattern; distance:-17; within:17; sid:10121541; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain morganisageek.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".morganisageek.org"; fast_pattern; distance:-18; within:18; sid:10121542; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain morganisageek.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".morganisageek.org"; fast_pattern; distance:-18; within:18; sid:10121543; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain radiogirl.fm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".radiogirl.fm"; fast_pattern; distance:-13; within:13; sid:10121544; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain radiogirl.fm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".radiogirl.fm"; fast_pattern; distance:-13; within:13; sid:10121545; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-education.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e-education.hk"; fast_pattern; distance:-15; within:15; sid:10121546; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-education.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e-education.hk"; fast_pattern; distance:-15; within:15; sid:10121547; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tn.my"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tn.my"; fast_pattern; distance:-6; within:6; sid:10121548; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tn.my in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tn.my"; fast_pattern; distance:-6; within:6; sid:10121549; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain colegiotorrevilano.es"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".colegiotorrevilano.es"; fast_pattern; distance:-22; within:22; sid:10121550; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain colegiotorrevilano.es in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".colegiotorrevilano.es"; fast_pattern; distance:-22; within:22; sid:10121551; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain olife.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".olife.org"; fast_pattern; distance:-10; within:10; sid:10121552; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain olife.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".olife.org"; fast_pattern; distance:-10; within:10; sid:10121553; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain scottlewisonline.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scottlewisonline.com"; fast_pattern; distance:-21; within:21; sid:10121554; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain scottlewisonline.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scottlewisonline.com"; fast_pattern; distance:-21; within:21; sid:10121555; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain digitalgroupe.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".digitalgroupe.com"; fast_pattern; distance:-18; within:18; sid:10121556; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain digitalgroupe.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".digitalgroupe.com"; fast_pattern; distance:-18; within:18; sid:10121557; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sly.io"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sly.io"; fast_pattern; distance:-7; within:7; sid:10121558; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sly.io in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sly.io"; fast_pattern; distance:-7; within:7; sid:10121559; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain taivas.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".taivas.biz"; fast_pattern; distance:-11; within:11; sid:10121560; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain taivas.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".taivas.biz"; fast_pattern; distance:-11; within:11; sid:10121561; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain wojb.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wojb.org"; fast_pattern; distance:-9; within:9; sid:10121562; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain wojb.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wojb.org"; fast_pattern; distance:-9; within:9; sid:10121563; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shoppingexpress.com.au"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shoppingexpress.com.au"; fast_pattern; distance:-23; within:23; sid:10121564; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shoppingexpress.com.au in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shoppingexpress.com.au"; fast_pattern; distance:-23; within:23; sid:10121565; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rltk.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rltk.org"; fast_pattern; distance:-9; within:9; sid:10121566; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rltk.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rltk.org"; fast_pattern; distance:-9; within:9; sid:10121567; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain notici.as"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".notici.as"; fast_pattern; distance:-10; within:10; sid:10121568; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain notici.as in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".notici.as"; fast_pattern; distance:-10; within:10; sid:10121569; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shen.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shen.cl"; fast_pattern; distance:-8; within:8; sid:10121570; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shen.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shen.cl"; fast_pattern; distance:-8; within:8; sid:10121571; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain solfa.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".solfa.org"; fast_pattern; distance:-10; within:10; sid:10121572; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain solfa.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".solfa.org"; fast_pattern; distance:-10; within:10; sid:10121573; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agila.com.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".agila.com.br"; fast_pattern; distance:-13; within:13; sid:10121574; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agila.com.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".agila.com.br"; fast_pattern; distance:-13; within:13; sid:10121575; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jesus.si"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jesus.si"; fast_pattern; distance:-9; within:9; sid:10121576; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jesus.si in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jesus.si"; fast_pattern; distance:-9; within:9; sid:10121577; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nlpd.net.au"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nlpd.net.au"; fast_pattern; distance:-12; within:12; sid:10121578; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nlpd.net.au in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nlpd.net.au"; fast_pattern; distance:-12; within:12; sid:10121579; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tagan-rog.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tagan-rog.info"; fast_pattern; distance:-15; within:15; sid:10121580; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tagan-rog.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tagan-rog.info"; fast_pattern; distance:-15; within:15; sid:10121581; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rcrcc.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rcrcc.ca"; fast_pattern; distance:-9; within:9; sid:10121582; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rcrcc.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rcrcc.ca"; fast_pattern; distance:-9; within:9; sid:10121583; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vistnet.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vistnet.net"; fast_pattern; distance:-12; within:12; sid:10121584; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vistnet.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vistnet.net"; fast_pattern; distance:-12; within:12; sid:10121585; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-m-a-i-l.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e-m-a-i-l.org"; fast_pattern; distance:-14; within:14; sid:10121586; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-m-a-i-l.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e-m-a-i-l.org"; fast_pattern; distance:-14; within:14; sid:10121587; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain endlessmovie.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endlessmovie.com"; fast_pattern; distance:-17; within:17; sid:10121588; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain endlessmovie.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endlessmovie.com"; fast_pattern; distance:-17; within:17; sid:10121589; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evilrouter.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".evilrouter.com"; fast_pattern; distance:-15; within:15; sid:10121590; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evilrouter.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".evilrouter.com"; fast_pattern; distance:-15; within:15; sid:10121591; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain auraria.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".auraria.org"; fast_pattern; distance:-12; within:12; sid:10121592; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain auraria.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".auraria.org"; fast_pattern; distance:-12; within:12; sid:10121593; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ccmissoula.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ccmissoula.com"; fast_pattern; distance:-15; within:15; sid:10121594; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ccmissoula.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ccmissoula.com"; fast_pattern; distance:-15; within:15; sid:10121595; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blogs.or.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogs.or.id"; fast_pattern; distance:-12; within:12; sid:10121596; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain blogs.or.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogs.or.id"; fast_pattern; distance:-12; within:12; sid:10121597; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e.co.za"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e.co.za"; fast_pattern; distance:-8; within:8; sid:10121598; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e.co.za in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e.co.za"; fast_pattern; distance:-8; within:8; sid:10121599; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zhilcontrol.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zhilcontrol.ru"; fast_pattern; distance:-15; within:15; sid:10121600; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zhilcontrol.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zhilcontrol.ru"; fast_pattern; distance:-15; within:15; sid:10121601; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ns22.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns22.ru"; fast_pattern; distance:-8; within:8; sid:10121602; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ns22.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns22.ru"; fast_pattern; distance:-8; within:8; sid:10121603; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qlbv.vn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qlbv.vn"; fast_pattern; distance:-8; within:8; sid:10121604; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qlbv.vn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qlbv.vn"; fast_pattern; distance:-8; within:8; sid:10121605; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain prostore.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".prostore.ru"; fast_pattern; distance:-12; within:12; sid:10121606; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain prostore.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".prostore.ru"; fast_pattern; distance:-12; within:12; sid:10121607; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain divakeramika.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".divakeramika.com"; fast_pattern; distance:-17; within:17; sid:10121608; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain divakeramika.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".divakeramika.com"; fast_pattern; distance:-17; within:17; sid:10121609; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sweetriders.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sweetriders.com"; fast_pattern; distance:-16; within:16; sid:10121610; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sweetriders.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sweetriders.com"; fast_pattern; distance:-16; within:16; sid:10121611; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain make.com.ar"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".make.com.ar"; fast_pattern; distance:-12; within:12; sid:10121612; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain make.com.ar in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".make.com.ar"; fast_pattern; distance:-12; within:12; sid:10121613; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain smelly.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".smelly.cc"; fast_pattern; distance:-10; within:10; sid:10121614; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain smelly.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".smelly.cc"; fast_pattern; distance:-10; within:10; sid:10121615; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain b33r.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".b33r.us"; fast_pattern; distance:-8; within:8; sid:10121616; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain b33r.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".b33r.us"; fast_pattern; distance:-8; within:8; sid:10121617; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gerastar.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gerastar.ru"; fast_pattern; distance:-12; within:12; sid:10121618; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gerastar.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gerastar.ru"; fast_pattern; distance:-12; within:12; sid:10121619; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tvlinux.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tvlinux.com"; fast_pattern; distance:-12; within:12; sid:10121620; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tvlinux.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tvlinux.com"; fast_pattern; distance:-12; within:12; sid:10121621; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain linux70.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".linux70.ru"; fast_pattern; distance:-11; within:11; sid:10121622; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain linux70.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".linux70.ru"; fast_pattern; distance:-11; within:11; sid:10121623; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dellsale.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dellsale.ru"; fast_pattern; distance:-12; within:12; sid:10121624; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dellsale.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dellsale.ru"; fast_pattern; distance:-12; within:12; sid:10121625; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lolk.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lolk.org"; fast_pattern; distance:-9; within:9; sid:10121626; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lolk.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lolk.org"; fast_pattern; distance:-9; within:9; sid:10121627; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain priamaakcia.sk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".priamaakcia.sk"; fast_pattern; distance:-15; within:15; sid:10121628; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain priamaakcia.sk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".priamaakcia.sk"; fast_pattern; distance:-15; within:15; sid:10121629; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain aintno.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".aintno.info"; fast_pattern; distance:-12; within:12; sid:10121630; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain aintno.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".aintno.info"; fast_pattern; distance:-12; within:12; sid:10121631; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jcor.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jcor.ca"; fast_pattern; distance:-8; within:8; sid:10121632; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jcor.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jcor.ca"; fast_pattern; distance:-8; within:8; sid:10121633; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kein.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kein.hk"; fast_pattern; distance:-8; within:8; sid:10121634; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kein.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kein.hk"; fast_pattern; distance:-8; within:8; sid:10121635; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain procare.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".procare.co.id"; fast_pattern; distance:-14; within:14; sid:10121636; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain procare.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".procare.co.id"; fast_pattern; distance:-14; within:14; sid:10121637; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tv-l.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tv-l.ru"; fast_pattern; distance:-8; within:8; sid:10121638; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tv-l.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tv-l.ru"; fast_pattern; distance:-8; within:8; sid:10121639; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain diipl.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".diipl.com"; fast_pattern; distance:-10; within:10; sid:10121640; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain diipl.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".diipl.com"; fast_pattern; distance:-10; within:10; sid:10121641; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain null.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".null.rs"; fast_pattern; distance:-8; within:8; sid:10121642; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain null.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".null.rs"; fast_pattern; distance:-8; within:8; sid:10121643; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain reason.org.nz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".reason.org.nz"; fast_pattern; distance:-14; within:14; sid:10121644; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain reason.org.nz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".reason.org.nz"; fast_pattern; distance:-14; within:14; sid:10121645; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyminecraft.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".happyminecraft.com"; fast_pattern; distance:-19; within:19; sid:10121646; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyminecraft.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".happyminecraft.com"; fast_pattern; distance:-19; within:19; sid:10121647; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain plnntt.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".plnntt.co.id"; fast_pattern; distance:-13; within:13; sid:10121648; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain plnntt.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".plnntt.co.id"; fast_pattern; distance:-13; within:13; sid:10121649; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain everton.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".everton.com"; fast_pattern; distance:-12; within:12; sid:10121650; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain everton.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".everton.com"; fast_pattern; distance:-12; within:12; sid:10121651; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gurcanozturk.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gurcanozturk.com"; fast_pattern; distance:-17; within:17; sid:10121652; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gurcanozturk.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gurcanozturk.com"; fast_pattern; distance:-17; within:17; sid:10121653; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jpfiles.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jpfiles.eu"; fast_pattern; distance:-11; within:11; sid:10121654; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jpfiles.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jpfiles.eu"; fast_pattern; distance:-11; within:11; sid:10121655; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kiani.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kiani.com"; fast_pattern; distance:-10; within:10; sid:10121656; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kiani.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kiani.com"; fast_pattern; distance:-10; within:10; sid:10121657; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain caturelang.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".caturelang.co.id"; fast_pattern; distance:-17; within:17; sid:10121658; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain caturelang.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".caturelang.co.id"; fast_pattern; distance:-17; within:17; sid:10121659; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pckf.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pckf.com"; fast_pattern; distance:-9; within:9; sid:10121660; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pckf.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pckf.com"; fast_pattern; distance:-9; within:9; sid:10121661; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain trumgame.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".trumgame.net"; fast_pattern; distance:-13; within:13; sid:10121662; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain trumgame.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".trumgame.net"; fast_pattern; distance:-13; within:13; sid:10121663; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain brawlcustommusic.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".brawlcustommusic.com"; fast_pattern; distance:-21; within:21; sid:10121664; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain brawlcustommusic.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".brawlcustommusic.com"; fast_pattern; distance:-21; within:21; sid:10121665; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dnet.hu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnet.hu"; fast_pattern; distance:-8; within:8; sid:10121666; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dnet.hu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnet.hu"; fast_pattern; distance:-8; within:8; sid:10121667; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain innograph.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".innograph.co.id"; fast_pattern; distance:-16; within:16; sid:10121668; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain innograph.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".innograph.co.id"; fast_pattern; distance:-16; within:16; sid:10121669; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sith.su"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sith.su"; fast_pattern; distance:-8; within:8; sid:10121670; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sith.su in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sith.su"; fast_pattern; distance:-8; within:8; sid:10121671; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain naru.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".naru.to"; fast_pattern; distance:-8; within:8; sid:10121672; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain naru.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".naru.to"; fast_pattern; distance:-8; within:8; sid:10121673; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 8634.su"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".8634.su"; fast_pattern; distance:-8; within:8; sid:10121674; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 8634.su in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".8634.su"; fast_pattern; distance:-8; within:8; sid:10121675; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ivi.pl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ivi.pl"; fast_pattern; distance:-7; within:7; sid:10121676; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ivi.pl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ivi.pl"; fast_pattern; distance:-7; within:7; sid:10121677; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain polissya.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".polissya.eu"; fast_pattern; distance:-12; within:12; sid:10121678; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain polissya.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".polissya.eu"; fast_pattern; distance:-12; within:12; sid:10121679; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hitremixes.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hitremixes.com"; fast_pattern; distance:-15; within:15; sid:10121680; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hitremixes.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hitremixes.com"; fast_pattern; distance:-15; within:15; sid:10121681; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain m-kopa.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".m-kopa.net"; fast_pattern; distance:-11; within:11; sid:10121682; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain m-kopa.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".m-kopa.net"; fast_pattern; distance:-11; within:11; sid:10121683; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain netmask.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".netmask.ca"; fast_pattern; distance:-11; within:11; sid:10121684; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain netmask.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".netmask.ca"; fast_pattern; distance:-11; within:11; sid:10121685; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain warmkessel.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".warmkessel.com"; fast_pattern; distance:-15; within:15; sid:10121686; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain warmkessel.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".warmkessel.com"; fast_pattern; distance:-15; within:15; sid:10121687; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hayeshelp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hayeshelp.com"; fast_pattern; distance:-14; within:14; sid:10121688; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hayeshelp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hayeshelp.com"; fast_pattern; distance:-14; within:14; sid:10121689; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yourspecialtee.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".yourspecialtee.com"; fast_pattern; distance:-19; within:19; sid:10121690; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yourspecialtee.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".yourspecialtee.com"; fast_pattern; distance:-19; within:19; sid:10121691; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain donkeyhot.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".donkeyhot.net"; fast_pattern; distance:-14; within:14; sid:10121692; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain donkeyhot.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".donkeyhot.net"; fast_pattern; distance:-14; within:14; sid:10121693; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2ku.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".2ku.ru"; fast_pattern; distance:-7; within:7; sid:10121694; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 2ku.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".2ku.ru"; fast_pattern; distance:-7; within:7; sid:10121695; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gebish.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gebish.org"; fast_pattern; distance:-11; within:11; sid:10121696; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gebish.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gebish.org"; fast_pattern; distance:-11; within:11; sid:10121697; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain russkoeumea.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".russkoeumea.com"; fast_pattern; distance:-16; within:16; sid:10121698; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain russkoeumea.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".russkoeumea.com"; fast_pattern; distance:-16; within:16; sid:10121699; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain haki.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".haki.hk"; fast_pattern; distance:-8; within:8; sid:10121700; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain haki.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".haki.hk"; fast_pattern; distance:-8; within:8; sid:10121701; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ilkor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ilkor.com"; fast_pattern; distance:-10; within:10; sid:10121702; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ilkor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ilkor.com"; fast_pattern; distance:-10; within:10; sid:10121703; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mett.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mett.ru"; fast_pattern; distance:-8; within:8; sid:10121704; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mett.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mett.ru"; fast_pattern; distance:-8; within:8; sid:10121705; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain orskkino.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".orskkino.ru"; fast_pattern; distance:-12; within:12; sid:10121706; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain orskkino.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".orskkino.ru"; fast_pattern; distance:-12; within:12; sid:10121707; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain swsc.org.np"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".swsc.org.np"; fast_pattern; distance:-12; within:12; sid:10121708; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain swsc.org.np in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".swsc.org.np"; fast_pattern; distance:-12; within:12; sid:10121709; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 150watt.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".150watt.ru"; fast_pattern; distance:-11; within:11; sid:10121710; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 150watt.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".150watt.ru"; fast_pattern; distance:-11; within:11; sid:10121711; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dp76.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dp76.com"; fast_pattern; distance:-9; within:9; sid:10121712; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dp76.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dp76.com"; fast_pattern; distance:-9; within:9; sid:10121713; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gtk.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gtk.cl"; fast_pattern; distance:-7; within:7; sid:10121714; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gtk.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gtk.cl"; fast_pattern; distance:-7; within:7; sid:10121715; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privateimport.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".privateimport.jp"; fast_pattern; distance:-17; within:17; sid:10121716; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privateimport.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".privateimport.jp"; fast_pattern; distance:-17; within:17; sid:10121717; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tedx.ee"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tedx.ee"; fast_pattern; distance:-8; within:8; sid:10121718; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tedx.ee in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tedx.ee"; fast_pattern; distance:-8; within:8; sid:10121719; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tru.io"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tru.io"; fast_pattern; distance:-7; within:7; sid:10121720; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tru.io in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tru.io"; fast_pattern; distance:-7; within:7; sid:10121721; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cc.net.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cc.net.br"; fast_pattern; distance:-10; within:10; sid:10121722; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cc.net.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cc.net.br"; fast_pattern; distance:-10; within:10; sid:10121723; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lanas.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lanas.cl"; fast_pattern; distance:-9; within:9; sid:10121724; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain lanas.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lanas.cl"; fast_pattern; distance:-9; within:9; sid:10121725; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ugo.si"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ugo.si"; fast_pattern; distance:-7; within:7; sid:10121726; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ugo.si in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ugo.si"; fast_pattern; distance:-7; within:7; sid:10121727; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain elitter.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".elitter.net"; fast_pattern; distance:-12; within:12; sid:10121728; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain elitter.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".elitter.net"; fast_pattern; distance:-12; within:12; sid:10121729; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evs.net.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".evs.net.br"; fast_pattern; distance:-11; within:11; sid:10121730; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evs.net.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".evs.net.br"; fast_pattern; distance:-11; within:11; sid:10121731; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jundy.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jundy.org"; fast_pattern; distance:-10; within:10; sid:10121732; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jundy.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jundy.org"; fast_pattern; distance:-10; within:10; sid:10121733; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nevskayaratusha.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nevskayaratusha.ru"; fast_pattern; distance:-19; within:19; sid:10121734; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nevskayaratusha.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nevskayaratusha.ru"; fast_pattern; distance:-19; within:19; sid:10121735; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain technopagans.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".technopagans.com"; fast_pattern; distance:-17; within:17; sid:10121736; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain technopagans.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".technopagans.com"; fast_pattern; distance:-17; within:17; sid:10121737; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain asianfreshproduce.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".asianfreshproduce.com"; fast_pattern; distance:-22; within:22; sid:10121738; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain asianfreshproduce.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".asianfreshproduce.com"; fast_pattern; distance:-22; within:22; sid:10121739; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hijaxdesigns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hijaxdesigns.com"; fast_pattern; distance:-17; within:17; sid:10121740; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hijaxdesigns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hijaxdesigns.com"; fast_pattern; distance:-17; within:17; sid:10121741; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain morganisageek.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".morganisageek.org"; fast_pattern; distance:-18; within:18; sid:10121742; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain morganisageek.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".morganisageek.org"; fast_pattern; distance:-18; within:18; sid:10121743; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain radiogirl.fm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".radiogirl.fm"; fast_pattern; distance:-13; within:13; sid:10121744; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain radiogirl.fm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".radiogirl.fm"; fast_pattern; distance:-13; within:13; sid:10121745; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-education.hk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e-education.hk"; fast_pattern; distance:-15; within:15; sid:10121746; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-education.hk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e-education.hk"; fast_pattern; distance:-15; within:15; sid:10121747; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tn.my"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tn.my"; fast_pattern; distance:-6; within:6; sid:10121748; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tn.my in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tn.my"; fast_pattern; distance:-6; within:6; sid:10121749; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain colegiotorrevilano.es"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".colegiotorrevilano.es"; fast_pattern; distance:-22; within:22; sid:10121750; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain colegiotorrevilano.es in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".colegiotorrevilano.es"; fast_pattern; distance:-22; within:22; sid:10121751; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain olife.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".olife.org"; fast_pattern; distance:-10; within:10; sid:10121752; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain olife.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".olife.org"; fast_pattern; distance:-10; within:10; sid:10121753; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain scottlewisonline.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scottlewisonline.com"; fast_pattern; distance:-21; within:21; sid:10121754; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain scottlewisonline.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scottlewisonline.com"; fast_pattern; distance:-21; within:21; sid:10121755; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain digitalgroupe.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".digitalgroupe.com"; fast_pattern; distance:-18; within:18; sid:10121756; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain digitalgroupe.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".digitalgroupe.com"; fast_pattern; distance:-18; within:18; sid:10121757; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sly.io"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sly.io"; fast_pattern; distance:-7; within:7; sid:10121758; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain sly.io in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sly.io"; fast_pattern; distance:-7; within:7; sid:10121759; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain taivas.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".taivas.biz"; fast_pattern; distance:-11; within:11; sid:10121760; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain taivas.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".taivas.biz"; fast_pattern; distance:-11; within:11; sid:10121761; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain wojb.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wojb.org"; fast_pattern; distance:-9; within:9; sid:10121762; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain wojb.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wojb.org"; fast_pattern; distance:-9; within:9; sid:10121763; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shoppingexpress.com.au"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shoppingexpress.com.au"; fast_pattern; distance:-23; within:23; sid:10121764; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shoppingexpress.com.au in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shoppingexpress.com.au"; fast_pattern; distance:-23; within:23; sid:10121765; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rltk.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rltk.org"; fast_pattern; distance:-9; within:9; sid:10121766; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rltk.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rltk.org"; fast_pattern; distance:-9; within:9; sid:10121767; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain notici.as"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".notici.as"; fast_pattern; distance:-10; within:10; sid:10121768; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain notici.as in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".notici.as"; fast_pattern; distance:-10; within:10; sid:10121769; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shen.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shen.cl"; fast_pattern; distance:-8; within:8; sid:10121770; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shen.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shen.cl"; fast_pattern; distance:-8; within:8; sid:10121771; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain solfa.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".solfa.org"; fast_pattern; distance:-10; within:10; sid:10121772; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain solfa.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".solfa.org"; fast_pattern; distance:-10; within:10; sid:10121773; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agila.com.br"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".agila.com.br"; fast_pattern; distance:-13; within:13; sid:10121774; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agila.com.br in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".agila.com.br"; fast_pattern; distance:-13; within:13; sid:10121775; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jesus.si"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jesus.si"; fast_pattern; distance:-9; within:9; sid:10121776; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jesus.si in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jesus.si"; fast_pattern; distance:-9; within:9; sid:10121777; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nlpd.net.au"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nlpd.net.au"; fast_pattern; distance:-12; within:12; sid:10121778; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nlpd.net.au in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nlpd.net.au"; fast_pattern; distance:-12; within:12; sid:10121779; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tagan-rog.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tagan-rog.info"; fast_pattern; distance:-15; within:15; sid:10121780; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain tagan-rog.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tagan-rog.info"; fast_pattern; distance:-15; within:15; sid:10121781; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rcrcc.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rcrcc.ca"; fast_pattern; distance:-9; within:9; sid:10121782; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain rcrcc.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rcrcc.ca"; fast_pattern; distance:-9; within:9; sid:10121783; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vistnet.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vistnet.net"; fast_pattern; distance:-12; within:12; sid:10121784; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vistnet.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vistnet.net"; fast_pattern; distance:-12; within:12; sid:10121785; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-m-a-i-l.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".e-m-a-i-l.org"; fast_pattern; distance:-14; within:14; sid:10121786; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain e-m-a-i-l.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".e-m-a-i-l.org"; fast_pattern; distance:-14; within:14; sid:10121787; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain endlessmovie.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endlessmovie.com"; fast_pattern; distance:-17; within:17; sid:10121788; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain endlessmovie.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endlessmovie.com"; fast_pattern; distance:-17; within:17; sid:10121789; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evilrouter.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".evilrouter.com"; fast_pattern; distance:-15; within:15; sid:10121790; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evilrouter.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".evilrouter.com"; fast_pattern; distance:-15; within:15; sid:10121791; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain auraria.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".auraria.org"; fast_pattern; distance:-12; within:12; sid:10121792; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain auraria.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".auraria.org"; fast_pattern; distance:-12; within:12; sid:10121793; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain darktech.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".darktech.org"; fast_pattern; distance:-13; within:13; sid:10121794; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain darktech.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".darktech.org"; fast_pattern; distance:-13; within:13; sid:10121795; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain effers.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".effers.com"; fast_pattern; distance:-11; within:11; sid:10121796; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain effers.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".effers.com"; fast_pattern; distance:-11; within:11; sid:10121797; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain 4irc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".4irc.com"; fast_pattern; distance:-9; within:9; sid:10121798; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain 4irc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".4irc.com"; fast_pattern; distance:-9; within:9; sid:10121799; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain slyip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".slyip.net"; fast_pattern; distance:-10; within:10; sid:10121800; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain slyip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".slyip.net"; fast_pattern; distance:-10; within:10; sid:10121801; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain bbsindex.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bbsindex.com"; fast_pattern; distance:-13; within:13; sid:10121802; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain bbsindex.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bbsindex.com"; fast_pattern; distance:-13; within:13; sid:10121803; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain chatnook.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".chatnook.com"; fast_pattern; distance:-13; within:13; sid:10121804; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain chatnook.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".chatnook.com"; fast_pattern; distance:-13; within:13; sid:10121805; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain b0ne.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".b0ne.com"; fast_pattern; distance:-9; within:9; sid:10121806; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain b0ne.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".b0ne.com"; fast_pattern; distance:-9; within:9; sid:10121807; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain slyip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".slyip.com"; fast_pattern; distance:-10; within:10; sid:10121808; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain slyip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".slyip.com"; fast_pattern; distance:-10; within:10; sid:10121809; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain 3d-game.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3d-game.com"; fast_pattern; distance:-12; within:12; sid:10121810; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain 3d-game.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3d-game.com"; fast_pattern; distance:-12; within:12; sid:10121811; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain suroot.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".suroot.com"; fast_pattern; distance:-11; within:11; sid:10121812; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain suroot.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".suroot.com"; fast_pattern; distance:-11; within:11; sid:10121813; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain etowns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".etowns.org"; fast_pattern; distance:-11; within:11; sid:10121814; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain etowns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".etowns.org"; fast_pattern; distance:-11; within:11; sid:10121815; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain dtdns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dtdns.net"; fast_pattern; distance:-10; within:10; sid:10121816; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain dtdns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dtdns.net"; fast_pattern; distance:-10; within:10; sid:10121817; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain gotgeeks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotgeeks.com"; fast_pattern; distance:-13; within:13; sid:10121818; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain gotgeeks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotgeeks.com"; fast_pattern; distance:-13; within:13; sid:10121819; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain scieron.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scieron.com"; fast_pattern; distance:-12; within:12; sid:10121820; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain scieron.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scieron.com"; fast_pattern; distance:-12; within:12; sid:10121821; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain etowns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".etowns.net"; fast_pattern; distance:-11; within:11; sid:10121822; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain etowns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".etowns.net"; fast_pattern; distance:-11; within:11; sid:10121823; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain flnet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".flnet.org"; fast_pattern; distance:-10; within:10; sid:10121824; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain flnet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".flnet.org"; fast_pattern; distance:-10; within:10; sid:10121825; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain deaftone.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".deaftone.com"; fast_pattern; distance:-13; within:13; sid:10121826; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DTDNS domain deaftone.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".deaftone.com"; fast_pattern; distance:-13; within:13; sid:10121827; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain zzux.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zzux.com"; fast_pattern; distance:-9; within:9; sid:10121828; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain zzux.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zzux.com"; fast_pattern; distance:-9; within:9; sid:10121829; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".onmypc.info"; fast_pattern; distance:-12; within:12; sid:10121830; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".onmypc.info"; fast_pattern; distance:-12; within:12; sid:10121831; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflinkup.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lflinkup.org"; fast_pattern; distance:-13; within:13; sid:10121832; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflinkup.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lflinkup.org"; fast_pattern; distance:-13; within:13; sid:10121833; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.me.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynamicdns.me.uk"; fast_pattern; distance:-17; within:17; sid:10121834; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.me.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynamicdns.me.uk"; fast_pattern; distance:-17; within:17; sid:10121835; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ourhobby.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ourhobby.com"; fast_pattern; distance:-13; within:13; sid:10121836; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ourhobby.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ourhobby.com"; fast_pattern; distance:-13; within:13; sid:10121837; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".onmypc.us"; fast_pattern; distance:-10; within:10; sid:10121838; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".onmypc.us"; fast_pattern; distance:-10; within:10; sid:10121839; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain itsaol.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".itsaol.com"; fast_pattern; distance:-11; within:11; sid:10121840; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain itsaol.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".itsaol.com"; fast_pattern; distance:-11; within:11; sid:10121841; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain instanthq.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".instanthq.com"; fast_pattern; distance:-14; within:14; sid:10121842; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain instanthq.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".instanthq.com"; fast_pattern; distance:-14; within:14; sid:10121843; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns2.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns2.name"; fast_pattern; distance:-9; within:9; sid:10121844; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns2.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns2.name"; fast_pattern; distance:-9; within:9; sid:10121845; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain wikaba.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wikaba.com"; fast_pattern; distance:-11; within:11; sid:10121846; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain wikaba.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wikaba.com"; fast_pattern; distance:-11; within:11; sid:10121847; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns02.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns02.biz"; fast_pattern; distance:-9; within:9; sid:10121848; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns02.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns02.biz"; fast_pattern; distance:-9; within:9; sid:10121849; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain https443.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".https443.org"; fast_pattern; distance:-13; within:13; sid:10121850; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain https443.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".https443.org"; fast_pattern; distance:-13; within:13; sid:10121851; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 1dumb.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".1dumb.com"; fast_pattern; distance:-10; within:10; sid:10121852; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 1dumb.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".1dumb.com"; fast_pattern; distance:-10; within:10; sid:10121853; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain https443.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".https443.net"; fast_pattern; distance:-13; within:13; sid:10121854; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain https443.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".https443.net"; fast_pattern; distance:-13; within:13; sid:10121855; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain serveusers.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveusers.com"; fast_pattern; distance:-15; within:15; sid:10121856; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain serveusers.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveusers.com"; fast_pattern; distance:-15; within:15; sid:10121857; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain jkub.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jkub.com"; fast_pattern; distance:-9; within:9; sid:10121858; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain jkub.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jkub.com"; fast_pattern; distance:-9; within:9; sid:10121859; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain qpoe.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qpoe.com"; fast_pattern; distance:-9; within:9; sid:10121860; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain qpoe.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qpoe.com"; fast_pattern; distance:-9; within:9; sid:10121861; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain organiccrap.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".organiccrap.com"; fast_pattern; distance:-16; within:16; sid:10121862; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain organiccrap.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".organiccrap.com"; fast_pattern; distance:-16; within:16; sid:10121863; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.mobi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.mobi"; fast_pattern; distance:-10; within:10; sid:10121864; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.mobi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.mobi"; fast_pattern; distance:-10; within:10; sid:10121865; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns04.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns04.com"; fast_pattern; distance:-10; within:10; sid:10121866; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns04.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns04.com"; fast_pattern; distance:-10; within:10; sid:10121867; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.org.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynamicdns.org.uk"; fast_pattern; distance:-18; within:18; sid:10121868; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.org.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynamicdns.org.uk"; fast_pattern; distance:-18; within:18; sid:10121869; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain authorizeddns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".authorizeddns.org"; fast_pattern; distance:-18; within:18; sid:10121870; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain authorizeddns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".authorizeddns.org"; fast_pattern; distance:-18; within:18; sid:10121871; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ikwb.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ikwb.com"; fast_pattern; distance:-9; within:9; sid:10121872; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ikwb.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ikwb.com"; fast_pattern; distance:-9; within:9; sid:10121873; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myftp.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myftp.name"; fast_pattern; distance:-11; within:11; sid:10121874; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myftp.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myftp.name"; fast_pattern; distance:-11; within:11; sid:10121875; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mymom.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mymom.info"; fast_pattern; distance:-11; within:11; sid:10121876; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mymom.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mymom.info"; fast_pattern; distance:-11; within:11; sid:10121877; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain squirly.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".squirly.info"; fast_pattern; distance:-13; within:13; sid:10121878; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain squirly.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".squirly.info"; fast_pattern; distance:-13; within:13; sid:10121879; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrbasic.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mrbasic.com"; fast_pattern; distance:-12; within:12; sid:10121880; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrbasic.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mrbasic.com"; fast_pattern; distance:-12; within:12; sid:10121881; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain serveuser.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveuser.com"; fast_pattern; distance:-14; within:14; sid:10121882; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain serveuser.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveuser.com"; fast_pattern; distance:-14; within:14; sid:10121883; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain epac.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".epac.to"; fast_pattern; distance:-8; within:8; sid:10121884; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain epac.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".epac.to"; fast_pattern; distance:-8; within:8; sid:10121885; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns-dns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns-dns.com"; fast_pattern; distance:-12; within:12; sid:10121886; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns-dns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns-dns.com"; fast_pattern; distance:-12; within:12; sid:10121887; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns02.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns02.info"; fast_pattern; distance:-10; within:10; sid:10121888; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns02.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns02.info"; fast_pattern; distance:-10; within:10; sid:10121889; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ocry.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ocry.com"; fast_pattern; distance:-9; within:9; sid:10121890; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ocry.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ocry.com"; fast_pattern; distance:-9; within:9; sid:10121891; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain authorizeddns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".authorizeddns.net"; fast_pattern; distance:-18; within:18; sid:10121892; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain authorizeddns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".authorizeddns.net"; fast_pattern; distance:-18; within:18; sid:10121893; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ninth.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ninth.biz"; fast_pattern; distance:-10; within:10; sid:10121894; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ninth.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ninth.biz"; fast_pattern; distance:-10; within:10; sid:10121895; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynamicdns.biz"; fast_pattern; distance:-15; within:15; sid:10121896; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynamicdns.biz"; fast_pattern; distance:-15; within:15; sid:10121897; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain changeip.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".changeip.org"; fast_pattern; distance:-13; within:13; sid:10121898; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain changeip.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".changeip.org"; fast_pattern; distance:-13; within:13; sid:10121899; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dyndns.pro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.pro"; fast_pattern; distance:-11; within:11; sid:10121900; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dyndns.pro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.pro"; fast_pattern; distance:-11; within:11; sid:10121901; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain pcanywhere.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pcanywhere.net"; fast_pattern; distance:-15; within:15; sid:10121902; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain pcanywhere.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pcanywhere.net"; fast_pattern; distance:-15; within:15; sid:10121903; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 25u.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".25u.com"; fast_pattern; distance:-8; within:8; sid:10121904; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 25u.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".25u.com"; fast_pattern; distance:-8; within:8; sid:10121905; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mydad.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mydad.info"; fast_pattern; distance:-11; within:11; sid:10121906; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mydad.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mydad.info"; fast_pattern; distance:-11; within:11; sid:10121907; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain cleansite.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cleansite.us"; fast_pattern; distance:-13; within:13; sid:10121908; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain cleansite.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cleansite.us"; fast_pattern; distance:-13; within:13; sid:10121909; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freetcp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".freetcp.com"; fast_pattern; distance:-12; within:12; sid:10121910; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freetcp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".freetcp.com"; fast_pattern; distance:-12; within:12; sid:10121911; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain rebatesrule.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".rebatesrule.net"; fast_pattern; distance:-16; within:16; sid:10121912; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain rebatesrule.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".rebatesrule.net"; fast_pattern; distance:-16; within:16; sid:10121913; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain zyns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zyns.com"; fast_pattern; distance:-9; within:9; sid:10121914; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain zyns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zyns.com"; fast_pattern; distance:-9; within:9; sid:10121915; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain toythieves.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".toythieves.com"; fast_pattern; distance:-15; within:15; sid:10121916; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain toythieves.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".toythieves.com"; fast_pattern; distance:-15; within:15; sid:10121917; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myddns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myddns.com"; fast_pattern; distance:-11; within:11; sid:10121918; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myddns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myddns.com"; fast_pattern; distance:-11; within:11; sid:10121919; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain got-game.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".got-game.org"; fast_pattern; distance:-13; within:13; sid:10121920; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain got-game.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".got-game.org"; fast_pattern; distance:-13; within:13; sid:10121921; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".onmypc.net"; fast_pattern; distance:-11; within:11; sid:10121922; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".onmypc.net"; fast_pattern; distance:-11; within:11; sid:10121923; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain vizvaz.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vizvaz.com"; fast_pattern; distance:-11; within:11; sid:10121924; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain vizvaz.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vizvaz.com"; fast_pattern; distance:-11; within:11; sid:10121925; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain gr8domain.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gr8domain.biz"; fast_pattern; distance:-14; within:14; sid:10121926; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain gr8domain.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gr8domain.biz"; fast_pattern; distance:-14; within:14; sid:10121927; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns05.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns05.com"; fast_pattern; distance:-10; within:10; sid:10121928; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns05.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns05.com"; fast_pattern; distance:-10; within:10; sid:10121929; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflinkup.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lflinkup.com"; fast_pattern; distance:-13; within:13; sid:10121930; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflinkup.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lflinkup.com"; fast_pattern; distance:-13; within:13; sid:10121931; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns-stuff.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns-stuff.com"; fast_pattern; distance:-14; within:14; sid:10121932; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns-stuff.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns-stuff.com"; fast_pattern; distance:-14; within:14; sid:10121933; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mynumber.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mynumber.org"; fast_pattern; distance:-13; within:13; sid:10121934; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mynumber.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mynumber.org"; fast_pattern; distance:-13; within:13; sid:10121935; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.info"; fast_pattern; distance:-10; within:10; sid:10121936; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.info"; fast_pattern; distance:-10; within:10; sid:10121937; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dsmtp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dsmtp.com"; fast_pattern; distance:-10; within:10; sid:10121938; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dsmtp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dsmtp.com"; fast_pattern; distance:-10; within:10; sid:10121939; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mynetav.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mynetav.net"; fast_pattern; distance:-12; within:12; sid:10121940; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mynetav.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mynetav.net"; fast_pattern; distance:-12; within:12; sid:10121941; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain proxydns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".proxydns.com"; fast_pattern; distance:-13; within:13; sid:10121942; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain proxydns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".proxydns.com"; fast_pattern; distance:-13; within:13; sid:10121943; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrface.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mrface.com"; fast_pattern; distance:-11; within:11; sid:10121944; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrface.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mrface.com"; fast_pattern; distance:-11; within:11; sid:10121945; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain jungleheart.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jungleheart.com"; fast_pattern; distance:-16; within:16; sid:10121946; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain jungleheart.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jungleheart.com"; fast_pattern; distance:-16; within:16; sid:10121947; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mypop3.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypop3.org"; fast_pattern; distance:-11; within:11; sid:10121948; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mypop3.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypop3.org"; fast_pattern; distance:-11; within:11; sid:10121949; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ftp1.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftp1.biz"; fast_pattern; distance:-9; within:9; sid:10121950; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ftp1.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftp1.biz"; fast_pattern; distance:-9; within:9; sid:10121951; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 4pu.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".4pu.com"; fast_pattern; distance:-8; within:8; sid:10121952; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 4pu.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".4pu.com"; fast_pattern; distance:-8; within:8; sid:10121953; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myz.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myz.info"; fast_pattern; distance:-9; within:9; sid:10121954; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myz.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myz.info"; fast_pattern; distance:-9; within:9; sid:10121955; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 4mydomain.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".4mydomain.com"; fast_pattern; distance:-14; within:14; sid:10121956; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 4mydomain.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".4mydomain.com"; fast_pattern; distance:-14; within:14; sid:10121957; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mynetav.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mynetav.org"; fast_pattern; distance:-12; within:12; sid:10121958; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mynetav.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mynetav.org"; fast_pattern; distance:-12; within:12; sid:10121959; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrbonus.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mrbonus.com"; fast_pattern; distance:-12; within:12; sid:10121960; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrbonus.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mrbonus.com"; fast_pattern; distance:-12; within:12; sid:10121961; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain trickip.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".trickip.org"; fast_pattern; distance:-12; within:12; sid:10121962; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain trickip.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".trickip.org"; fast_pattern; distance:-12; within:12; sid:10121963; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain trickip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".trickip.net"; fast_pattern; distance:-12; within:12; sid:10121964; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain trickip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".trickip.net"; fast_pattern; distance:-12; within:12; sid:10121965; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns1.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns1.us"; fast_pattern; distance:-8; within:8; sid:10121966; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns1.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns1.us"; fast_pattern; distance:-8; within:8; sid:10121967; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mysecondarydns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecondarydns.com"; fast_pattern; distance:-19; within:19; sid:10121968; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mysecondarydns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecondarydns.com"; fast_pattern; distance:-19; within:19; sid:10121969; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain xxxy.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xxxy.biz"; fast_pattern; distance:-9; within:9; sid:10121970; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain xxxy.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xxxy.biz"; fast_pattern; distance:-9; within:9; sid:10121971; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ftpserver.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftpserver.biz"; fast_pattern; distance:-14; within:14; sid:10121972; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ftpserver.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftpserver.biz"; fast_pattern; distance:-14; within:14; sid:10121973; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dhcp.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dhcp.biz"; fast_pattern; distance:-9; within:9; sid:10121974; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dhcp.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dhcp.biz"; fast_pattern; distance:-9; within:9; sid:10121975; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dnset.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnset.com"; fast_pattern; distance:-10; within:10; sid:10121976; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dnset.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnset.com"; fast_pattern; distance:-10; within:10; sid:10121977; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freeddns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".freeddns.com"; fast_pattern; distance:-13; within:13; sid:10121978; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freeddns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".freeddns.com"; fast_pattern; distance:-13; within:13; sid:10121979; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sendsmtp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sendsmtp.com"; fast_pattern; distance:-13; within:13; sid:10121980; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sendsmtp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sendsmtp.com"; fast_pattern; distance:-13; within:13; sid:10121981; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mefound.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mefound.com"; fast_pattern; distance:-12; within:12; sid:10121982; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mefound.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mefound.com"; fast_pattern; distance:-12; within:12; sid:10121983; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain port25.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".port25.biz"; fast_pattern; distance:-11; within:11; sid:10121984; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain port25.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".port25.biz"; fast_pattern; distance:-11; within:11; sid:10121985; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain americanunfinished.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".americanunfinished.com"; fast_pattern; distance:-23; within:23; sid:10121986; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain americanunfinished.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".americanunfinished.com"; fast_pattern; distance:-23; within:23; sid:10121987; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 4dq.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".4dq.com"; fast_pattern; distance:-8; within:8; sid:10121988; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 4dq.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".4dq.com"; fast_pattern; distance:-8; within:8; sid:10121989; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.co.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynamicdns.co.uk"; fast_pattern; distance:-17; within:17; sid:10121990; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynamicdns.co.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynamicdns.co.uk"; fast_pattern; distance:-17; within:17; sid:10121991; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain faqserv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".faqserv.com"; fast_pattern; distance:-12; within:12; sid:10121992; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain faqserv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".faqserv.com"; fast_pattern; distance:-12; within:12; sid:10121993; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain changeip.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".changeip.name"; fast_pattern; distance:-14; within:14; sid:10121994; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain changeip.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".changeip.name"; fast_pattern; distance:-14; within:14; sid:10121995; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain yourtrap.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".yourtrap.com"; fast_pattern; distance:-13; within:13; sid:10121996; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain yourtrap.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".yourtrap.com"; fast_pattern; distance:-13; within:13; sid:10121997; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain compress.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".compress.to"; fast_pattern; distance:-12; within:12; sid:10121998; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain compress.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".compress.to"; fast_pattern; distance:-12; within:12; sid:10121999; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain jetos.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jetos.com"; fast_pattern; distance:-10; within:10; sid:10122000; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain jetos.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jetos.com"; fast_pattern; distance:-10; within:10; sid:10122001; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain changeip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".changeip.net"; fast_pattern; distance:-13; within:13; sid:10122002; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain changeip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".changeip.net"; fast_pattern; distance:-13; within:13; sid:10122003; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain esmtp.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".esmtp.biz"; fast_pattern; distance:-10; within:10; sid:10122004; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain esmtp.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".esmtp.biz"; fast_pattern; distance:-10; within:10; sid:10122005; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain xxxy.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xxxy.info"; fast_pattern; distance:-10; within:10; sid:10122006; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain xxxy.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xxxy.info"; fast_pattern; distance:-10; within:10; sid:10122007; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain justdied.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".justdied.com"; fast_pattern; distance:-13; within:13; sid:10122008; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain justdied.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".justdied.com"; fast_pattern; distance:-13; within:13; sid:10122009; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.ms"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.ms"; fast_pattern; distance:-8; within:8; sid:10122010; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.ms in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.ms"; fast_pattern; distance:-8; within:8; sid:10122011; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynssl.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynssl.com"; fast_pattern; distance:-11; within:11; sid:10122012; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dynssl.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynssl.com"; fast_pattern; distance:-11; within:11; sid:10122013; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns2.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns2.us"; fast_pattern; distance:-8; within:8; sid:10122014; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dns2.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns2.us"; fast_pattern; distance:-8; within:8; sid:10122015; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns01.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns01.info"; fast_pattern; distance:-10; within:10; sid:10122016; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns01.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns01.info"; fast_pattern; distance:-10; within:10; sid:10122017; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain cleansite.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cleansite.biz"; fast_pattern; distance:-14; within:14; sid:10122018; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain cleansite.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cleansite.biz"; fast_pattern; distance:-14; within:14; sid:10122019; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sixth.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sixth.biz"; fast_pattern; distance:-10; within:10; sid:10122020; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sixth.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sixth.biz"; fast_pattern; distance:-10; within:10; sid:10122021; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ezua.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ezua.com"; fast_pattern; distance:-9; within:9; sid:10122022; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ezua.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ezua.com"; fast_pattern; distance:-9; within:9; sid:10122023; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain gr8name.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gr8name.biz"; fast_pattern; distance:-12; within:12; sid:10122024; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain gr8name.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gr8name.biz"; fast_pattern; distance:-12; within:12; sid:10122025; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain gettrials.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gettrials.com"; fast_pattern; distance:-14; within:14; sid:10122026; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain gettrials.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gettrials.com"; fast_pattern; distance:-14; within:14; sid:10122027; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns01.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns01.us"; fast_pattern; distance:-8; within:8; sid:10122028; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns01.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns01.us"; fast_pattern; distance:-8; within:8; sid:10122029; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myftp.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myftp.info"; fast_pattern; distance:-11; within:11; sid:10122030; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain myftp.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myftp.info"; fast_pattern; distance:-11; within:11; sid:10122031; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 3-a.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3-a.net"; fast_pattern; distance:-8; within:8; sid:10122032; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 3-a.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3-a.net"; fast_pattern; distance:-8; within:8; sid:10122033; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain wha.la"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wha.la"; fast_pattern; distance:-7; within:7; sid:10122034; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain wha.la in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wha.la"; fast_pattern; distance:-7; within:7; sid:10122035; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain itemdb.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".itemdb.com"; fast_pattern; distance:-11; within:11; sid:10122036; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain itemdb.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".itemdb.com"; fast_pattern; distance:-11; within:11; sid:10122037; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain isasecret.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isasecret.com"; fast_pattern; distance:-14; within:14; sid:10122038; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain isasecret.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isasecret.com"; fast_pattern; distance:-14; within:14; sid:10122039; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 2waky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".2waky.com"; fast_pattern; distance:-10; within:10; sid:10122040; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain 2waky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".2waky.com"; fast_pattern; distance:-10; within:10; sid:10122041; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns1.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns1.name"; fast_pattern; distance:-9; within:9; sid:10122042; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns1.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns1.name"; fast_pattern; distance:-9; within:9; sid:10122043; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sellclassics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sellclassics.com"; fast_pattern; distance:-17; within:17; sid:10122044; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sellclassics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sellclassics.com"; fast_pattern; distance:-17; within:17; sid:10122045; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain qhigh.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qhigh.com"; fast_pattern; distance:-10; within:10; sid:10122046; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain qhigh.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qhigh.com"; fast_pattern; distance:-10; within:10; sid:10122047; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".onmypc.biz"; fast_pattern; distance:-11; within:11; sid:10122048; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".onmypc.biz"; fast_pattern; distance:-11; within:11; sid:10122049; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sexidude.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sexidude.com"; fast_pattern; distance:-13; within:13; sid:10122050; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sexidude.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sexidude.com"; fast_pattern; distance:-13; within:13; sid:10122051; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain otzo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".otzo.com"; fast_pattern; distance:-9; within:9; sid:10122052; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain otzo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".otzo.com"; fast_pattern; distance:-9; within:9; sid:10122053; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain my03.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".my03.com"; fast_pattern; distance:-9; within:9; sid:10122054; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain my03.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".my03.com"; fast_pattern; distance:-9; within:9; sid:10122055; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain edns.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".edns.biz"; fast_pattern; distance:-9; within:9; sid:10122056; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain edns.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".edns.biz"; fast_pattern; distance:-9; within:9; sid:10122057; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain authorizeddns.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".authorizeddns.us"; fast_pattern; distance:-17; within:17; sid:10122058; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain authorizeddns.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".authorizeddns.us"; fast_pattern; distance:-17; within:17; sid:10122059; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflink.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lflink.com"; fast_pattern; distance:-11; within:11; sid:10122060; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflink.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lflink.com"; fast_pattern; distance:-11; within:11; sid:10122061; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mywww.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mywww.biz"; fast_pattern; distance:-10; within:10; sid:10122062; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mywww.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mywww.biz"; fast_pattern; distance:-10; within:10; sid:10122063; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns01.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns01.biz"; fast_pattern; distance:-9; within:9; sid:10122064; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns01.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns01.biz"; fast_pattern; distance:-9; within:9; sid:10122065; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain fartit.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fartit.com"; fast_pattern; distance:-11; within:11; sid:10122066; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain fartit.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fartit.com"; fast_pattern; distance:-11; within:11; sid:10122067; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain longmusic.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".longmusic.com"; fast_pattern; distance:-14; within:14; sid:10122068; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain longmusic.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".longmusic.com"; fast_pattern; distance:-14; within:14; sid:10122069; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain acmetoy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".acmetoy.com"; fast_pattern; distance:-12; within:12; sid:10122070; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain acmetoy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".acmetoy.com"; fast_pattern; distance:-12; within:12; sid:10122071; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ssl443.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ssl443.org"; fast_pattern; distance:-11; within:11; sid:10122072; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ssl443.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ssl443.org"; fast_pattern; distance:-11; within:11; sid:10122073; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain x24hr.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".x24hr.com"; fast_pattern; distance:-10; within:10; sid:10122074; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain x24hr.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".x24hr.com"; fast_pattern; distance:-10; within:10; sid:10122075; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.us"; fast_pattern; distance:-8; within:8; sid:10122076; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.us"; fast_pattern; distance:-8; within:8; sid:10122077; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mypop3.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypop3.net"; fast_pattern; distance:-11; within:11; sid:10122078; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mypop3.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypop3.net"; fast_pattern; distance:-11; within:11; sid:10122079; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns02.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns02.us"; fast_pattern; distance:-8; within:8; sid:10122080; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns02.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns02.us"; fast_pattern; distance:-8; within:8; sid:10122081; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain cleansite.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cleansite.info"; fast_pattern; distance:-15; within:15; sid:10122082; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain cleansite.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cleansite.info"; fast_pattern; distance:-15; within:15; sid:10122083; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain www1.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".www1.biz"; fast_pattern; distance:-9; within:9; sid:10122084; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain www1.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".www1.biz"; fast_pattern; distance:-9; within:9; sid:10122085; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain xxuz.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xxuz.com"; fast_pattern; distance:-9; within:9; sid:10122086; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain xxuz.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xxuz.com"; fast_pattern; distance:-9; within:9; sid:10122087; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain iownyour.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iownyour.org"; fast_pattern; distance:-13; within:13; sid:10122088; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain iownyour.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iownyour.org"; fast_pattern; distance:-13; within:13; sid:10122089; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain toh.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".toh.info"; fast_pattern; distance:-9; within:9; sid:10122090; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain toh.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".toh.info"; fast_pattern; distance:-9; within:9; sid:10122091; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain bigmoney.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bigmoney.biz"; fast_pattern; distance:-13; within:13; sid:10122092; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain bigmoney.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bigmoney.biz"; fast_pattern; distance:-13; within:13; sid:10122093; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".onmypc.org"; fast_pattern; distance:-11; within:11; sid:10122094; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onmypc.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".onmypc.org"; fast_pattern; distance:-11; within:11; sid:10122095; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrslove.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mrslove.com"; fast_pattern; distance:-12; within:12; sid:10122096; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mrslove.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mrslove.com"; fast_pattern; distance:-12; within:12; sid:10122097; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain moneyhome.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".moneyhome.biz"; fast_pattern; distance:-14; within:14; sid:10122098; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain moneyhome.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".moneyhome.biz"; fast_pattern; distance:-14; within:14; sid:10122099; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.name"; fast_pattern; distance:-10; within:10; sid:10122100; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.name"; fast_pattern; distance:-10; within:10; sid:10122101; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns3.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns3.name"; fast_pattern; distance:-9; within:9; sid:10122102; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ns3.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns3.name"; fast_pattern; distance:-9; within:9; sid:10122103; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freewww.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".freewww.biz"; fast_pattern; distance:-12; within:12; sid:10122104; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freewww.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".freewww.biz"; fast_pattern; distance:-12; within:12; sid:10122105; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mypicture.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypicture.info"; fast_pattern; distance:-15; within:15; sid:10122106; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mypicture.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypicture.info"; fast_pattern; distance:-15; within:15; sid:10122107; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.me.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.me.uk"; fast_pattern; distance:-11; within:11; sid:10122108; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ddns.me.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.me.uk"; fast_pattern; distance:-11; within:11; sid:10122109; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freewww.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".freewww.info"; fast_pattern; distance:-13; within:13; sid:10122110; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain freewww.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".freewww.info"; fast_pattern; distance:-13; within:13; sid:10122111; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dumb1.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dumb1.com"; fast_pattern; distance:-10; within:10; sid:10122112; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dumb1.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dumb1.com"; fast_pattern; distance:-10; within:10; sid:10122113; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dnsrd.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsrd.com"; fast_pattern; distance:-10; within:10; sid:10122114; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain dnsrd.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsrd.com"; fast_pattern; distance:-10; within:10; sid:10122115; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain iownyour.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iownyour.biz"; fast_pattern; distance:-13; within:13; sid:10122116; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain iownyour.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iownyour.biz"; fast_pattern; distance:-13; within:13; sid:10122117; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain youdontcare.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".youdontcare.com"; fast_pattern; distance:-16; within:16; sid:10122118; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain youdontcare.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".youdontcare.com"; fast_pattern; distance:-16; within:16; sid:10122119; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflinkup.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lflinkup.net"; fast_pattern; distance:-13; within:13; sid:10122120; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain lflinkup.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lflinkup.net"; fast_pattern; distance:-13; within:13; sid:10122121; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onedumb.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".onedumb.com"; fast_pattern; distance:-12; within:12; sid:10122122; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain onedumb.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".onedumb.com"; fast_pattern; distance:-12; within:12; sid:10122123; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain wwwhost.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wwwhost.biz"; fast_pattern; distance:-12; within:12; sid:10122124; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain wwwhost.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wwwhost.biz"; fast_pattern; distance:-12; within:12; sid:10122125; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain almostmy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".almostmy.com"; fast_pattern; distance:-13; within:13; sid:10122126; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain almostmy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".almostmy.com"; fast_pattern; distance:-13; within:13; sid:10122127; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mylftv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mylftv.com"; fast_pattern; distance:-11; within:11; sid:10122128; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain mylftv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mylftv.com"; fast_pattern; distance:-11; within:11; sid:10122129; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sexxxy.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sexxxy.biz"; fast_pattern; distance:-11; within:11; sid:10122130; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain sexxxy.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sexxxy.biz"; fast_pattern; distance:-11; within:11; sid:10122131; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ygto.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ygto.com"; fast_pattern; distance:-9; within:9; sid:10122132; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for ChangeIP.com domain ygto.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ygto.com"; fast_pattern; distance:-9; within:9; sid:10122133; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYNU.com domain dynu.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynu.com"; distance:-9; within:9; sid:10122134; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYNU.com domain dynu.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynu.com"; fast_pattern; distance:-9; within:9; sid:10122135; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYNU.com domain dynu.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynu.net"; distance:-9; within:9; sid:10122136; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYNU.com domain dynu.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynu.net"; fast_pattern; distance:-9; within:9; sid:10122137; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 6600.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".6600.org"; distance:-9; within:9; sid:10122138; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 6600.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".6600.org"; fast_pattern; distance:-9; within:9; sid:10122139; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 7766.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".7766.org"; distance:-9; within:9; sid:10122140; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 7766.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".7766.org"; fast_pattern; distance:-9; within:9; sid:10122141; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 8800.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".8800.org"; distance:-9; within:9; sid:10122142; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 8800.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".8800.org"; fast_pattern; distance:-9; within:9; sid:10122143; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain webok.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webok.net"; distance:-10; within:10; sid:10122144; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain webok.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webok.net"; fast_pattern; distance:-10; within:10; sid:10122145; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 2288.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".2288.org"; distance:-9; within:9; sid:10122146; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 2288.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".2288.org"; fast_pattern; distance:-9; within:9; sid:10122147; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 9966.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".9966.org"; distance:-9; within:9; sid:10122148; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 9966.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".9966.org"; fast_pattern; distance:-9; within:9; sid:10122149; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 8866.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".8866.org"; distance:-9; within:9; sid:10122150; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 8866.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".8866.org"; fast_pattern; distance:-9; within:9; sid:10122151; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 3322.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3322.org"; distance:-9; within:9; sid:10122152; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain 3322.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3322.org"; fast_pattern; distance:-9; within:9; sid:10122153; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain f3322.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".f3322.net"; distance:-10; within:10; sid:10122154; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain f3322.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".f3322.net"; fast_pattern; distance:-10; within:10; sid:10122155; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain eatuo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".eatuo.com"; distance:-10; within:10; sid:10122156; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain eatuo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".eatuo.com"; fast_pattern; distance:-10; within:10; sid:10122157; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain x3322.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".x3322.org"; distance:-10; within:10; sid:10122158; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for 3222.org domain x3322.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".x3322.org"; fast_pattern; distance:-10; within:10; sid:10122159; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain co.vu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".co.vu"; distance:-6; within:6; sid:10122160; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain co.vu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".co.vu"; fast_pattern; distance:-6; within:6; sid:10122161; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain gq"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gq"; distance:-3; within:3; sid:10122162; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain gq in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gq"; fast_pattern; distance:-3; within:3; sid:10122163; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain ml"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ml"; distance:-3; within:3; sid:10122164; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain ml in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ml"; fast_pattern; distance:-3; within:3; sid:10122165; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain cf"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cf"; distance:-3; within:3; sid:10122166; content:!"google.cf"; nocase; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain cf in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cf"; fast_pattern; distance:-3; within:3; sid:10122167; content:!"google.cf"; nocase; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain tk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tk"; distance:-3; within:3; sid:10122168; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain tk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tk"; fast_pattern; distance:-3; within:3; sid:10122169; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain ga"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ga"; distance:-3; within:3; sid:10122170; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Freenom domain ga in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ga"; fast_pattern; distance:-3; within:3; sid:10122171; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME oapg.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".oapg.org"; distance:-9; within:9; sid:10122172; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME domain oapg.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".oapg.org"; fast_pattern; distance:-9; within:9; sid:10122173; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME uni.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".uni.me"; distance:-7; within:7; sid:10122174; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME domain uni.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".uni.me"; fast_pattern; distance:-7; within:7; sid:10122175; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME cnc-cs.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cnc-cs.com"; distance:-11; within:11; sid:10122176; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME domain cnc-cs.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cnc-cs.com"; fast_pattern; distance:-11; within:11; sid:10122177; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME hyd.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hyd.me"; distance:-7; within:7; sid:10122178; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME domain hyd.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hyd.me"; fast_pattern; distance:-7; within:7; sid:10122179; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME co7.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".co7.us"; distance:-7; within:7; sid:10122180; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for UNI.ME domain co7.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".co7.us"; fast_pattern; distance:-7; within:7; sid:10122181; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DUCKDNS domain duckdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".duckdns.org"; distance:-12; within:12; sid:10122182; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DUCKDNS domain duckdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".duckdns.org"; fast_pattern; distance:-12; within:12; sid:10122183; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain spdns.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".spdns.eu"; distance:-9; within:9; sid:10122184; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain spdns.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".spdns.eu"; fast_pattern; distance:-9; within:9; sid:10122185; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain firewall-gateway.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".firewall-gateway.de"; distance:-20; within:20; sid:10122186; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain firewall-gateway.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".firewall-gateway.de"; fast_pattern; distance:-20; within:20; sid:10122187; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain firewall-gateway.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".firewall-gateway.com"; distance:-21; within:21; sid:10122188; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain firewall-gateway.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".firewall-gateway.com"; fast_pattern; distance:-21; within:21; sid:10122189; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain myfirewall.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myfirewall.org"; distance:-15; within:15; sid:10122190; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain myfirewall.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myfirewall.org"; fast_pattern; distance:-15; within:15; sid:10122191; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain my-router.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".my-router.de"; distance:-13; within:13; sid:10122192; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain my-router.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".my-router.de"; fast_pattern; distance:-13; within:13; sid:10122193; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain my-firewall.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".my-firewall.org"; distance:-16; within:16; sid:10122194; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain my-firewall.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".my-firewall.org"; fast_pattern; distance:-16; within:16; sid:10122195; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain my-gateway.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".my-gateway.de"; distance:-14; within:14; sid:10122196; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain my-gateway.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".my-gateway.de"; fast_pattern; distance:-14; within:14; sid:10122197; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain spdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".spdns.org"; distance:-10; within:10; sid:10122198; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for SPDNS domain spdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".spdns.org"; fast_pattern; distance:-10; within:10; sid:10122199; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dnsip.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsip.ru"; distance:-9; within:9; sid:10122200; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dnsip.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsip.ru"; fast_pattern; distance:-9; within:9; sid:10122201; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dns-free.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns-free.com"; distance:-13; within:13; sid:10122202; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dns-free.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns-free.com"; fast_pattern; distance:-13; within:13; sid:10122203; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dnsalias.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.ru"; distance:-12; within:12; sid:10122204; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dnsalias.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.ru"; fast_pattern; distance:-12; within:12; sid:10122205; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dyn-dns.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyn-dns.ru"; distance:-11; within:11; sid:10122206; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSALIAS domain dyn-dns.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyn-dns.ru"; fast_pattern; distance:-11; within:11; sid:10122207; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain mom"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mom"; distance:-4; within:4; sid:10122208; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain mom in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mom"; fast_pattern; distance:-4; within:4; sid:10122209; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain stream"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stream"; distance:-7; within:7; sid:10122210; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain stream in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stream"; fast_pattern; distance:-7; within:7; sid:10122211; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain win"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".win"; distance:-4; within:4; sid:10122212; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain win in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".win"; fast_pattern; distance:-4; within:4; sid:10122213; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain loan"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".loan"; distance:-5; within:5; sid:10122214; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain loan in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".loan"; fast_pattern; distance:-5; within:5; sid:10122215; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain site"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".site"; distance:-5; within:5; sid:10122216; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain site in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".site"; fast_pattern; distance:-5; within:5; sid:10122217; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain trade"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".trade"; distance:-6; within:6; sid:10122218; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain trade in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".trade"; fast_pattern; distance:-6; within:6; sid:10122219; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain date"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".date"; distance:-5; within:5; sid:10122220; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain date in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".date"; fast_pattern; distance:-5; within:5; sid:10122221; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain vip"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vip"; distance:-4; within:4; sid:10122222; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain vip in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vip"; fast_pattern; distance:-4; within:4; sid:10122223; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain gb"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gb"; distance:-3; within:3; sid:10122224; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain gb in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gb"; fast_pattern; distance:-3; within:3; sid:10122225; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain download"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".download"; distance:-9; within:9; sid:10122226; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain download in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".download"; fast_pattern; distance:-9; within:9; sid:10122227; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain click"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".click"; distance:-6; within:6; sid:10122228; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain click in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".click"; fast_pattern; distance:-6; within:6; sid:10122229; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain gdn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gdn"; distance:-4; within:4; sid:10122230; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain gdn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gdn"; fast_pattern; distance:-4; within:4; sid:10122231; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain blue"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blue"; distance:-5; within:5; sid:10122232; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain blue in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blue"; fast_pattern; distance:-5; within:5; sid:10122233; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain voyage"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".voyage"; distance:-7; within:7; sid:10122234; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain voyage in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".voyage"; fast_pattern; distance:-7; within:7; sid:10122235; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain pw"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pw"; distance:-3; within:3; sid:10122236; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain pw in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pw"; fast_pattern; distance:-3; within:3; sid:10122237; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain space"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".space"; distance:-6; within:6; sid:10122238; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain space in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".space"; fast_pattern; distance:-6; within:6; sid:10122239; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain top"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".top"; distance:-4; within:4; sid:10122240; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain top in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".top"; fast_pattern; distance:-4; within:4; sid:10122241; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain lol"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lol"; distance:-4; within:4; sid:10122242; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain lol in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lol"; fast_pattern; distance:-4; within:4; sid:10122243; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain accountant"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".accountant"; distance:-11; within:11; sid:10122244; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain accountant in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".accountant"; fast_pattern; distance:-11; within:11; sid:10122245; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain maison"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".maison"; distance:-7; within:7; sid:10122246; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain maison in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".maison"; fast_pattern; distance:-7; within:7; sid:10122247; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain ren"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ren"; distance:-4; within:4; sid:10122248; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain ren in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ren"; fast_pattern; distance:-4; within:4; sid:10122249; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain online"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".online"; distance:-7; within:7; sid:10122250; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain online in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".online"; fast_pattern; distance:-7; within:7; sid:10122251; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain party"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".party"; distance:-6; within:6; sid:10122252; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain party in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".party"; fast_pattern; distance:-6; within:6; sid:10122253; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain racing"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".racing"; distance:-7; within:7; sid:10122254; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain racing in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".racing"; fast_pattern; distance:-7; within:7; sid:10122255; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain pro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pro"; distance:-4; within:4; sid:10122256; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain pro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pro"; fast_pattern; distance:-4; within:4; sid:10122257; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain red"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".red"; distance:-4; within:4; sid:10122258; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain red in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".red"; fast_pattern; distance:-4; within:4; sid:10122259; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain website"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".website"; distance:-8; within:8; sid:10122260; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain website in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".website"; fast_pattern; distance:-8; within:8; sid:10122261; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain pink"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pink"; distance:-5; within:5; sid:10122262; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain pink in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pink"; fast_pattern; distance:-5; within:5; sid:10122263; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain cricket"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cricket"; distance:-8; within:8; sid:10122264; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain cricket in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cricket"; fast_pattern; distance:-8; within:8; sid:10122265; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain webcam"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webcam"; distance:-7; within:7; sid:10122266; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain webcam in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webcam"; fast_pattern; distance:-7; within:7; sid:10122267; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain club"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".club"; distance:-5; within:5; sid:10122268; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain club in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".club"; fast_pattern; distance:-5; within:5; sid:10122269; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain bid"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bid"; distance:-4; within:4; sid:10122270; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain bid in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bid"; fast_pattern; distance:-4; within:4; sid:10122271; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain men"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".men"; distance:-4; within:4; sid:10122272; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain men in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".men"; fast_pattern; distance:-4; within:4; sid:10122273; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain host"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".host"; distance:-5; within:5; sid:10122274; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain host in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".host"; fast_pattern; distance:-5; within:5; sid:10122275; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain link"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".link"; distance:-5; within:5; sid:10122276; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain link in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".link"; fast_pattern; distance:-5; within:5; sid:10122277; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain desi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".desi"; distance:-5; within:5; sid:10122278; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain desi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".desi"; fast_pattern; distance:-5; within:5; sid:10122279; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain kim"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kim"; distance:-4; within:4; sid:10122280; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain kim in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kim"; fast_pattern; distance:-4; within:4; sid:10122281; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain review"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".review"; distance:-7; within:7; sid:10122282; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain review in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".review"; fast_pattern; distance:-7; within:7; sid:10122283; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain press"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".press"; distance:-6; within:6; sid:10122284; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain press in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".press"; fast_pattern; distance:-6; within:6; sid:10122285; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain faith"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".faith"; distance:-6; within:6; sid:10122286; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain faith in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".faith"; fast_pattern; distance:-6; within:6; sid:10122287; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain mobi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mobi"; distance:-5; within:5; sid:10122288; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain mobi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mobi"; fast_pattern; distance:-5; within:5; sid:10122289; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain country"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".country"; distance:-8; within:8; sid:10122290; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain country in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".country"; fast_pattern; distance:-8; within:8; sid:10122291; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain xyz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xyz"; distance:-4; within:4; sid:10122292; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain xyz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xyz"; fast_pattern; distance:-4; within:4; sid:10122293; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain tech"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tech"; distance:-5; within:5; sid:10122294; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain tech in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tech"; fast_pattern; distance:-5; within:5; sid:10122295; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain science"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".science"; distance:-8; within:8; sid:10122296; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain science in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".science"; fast_pattern; distance:-8; within:8; sid:10122297; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain boutique"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".boutique"; distance:-9; within:9; sid:10122298; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Firesale gTLD domain boutique in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".boutique"; fast_pattern; distance:-9; within:9; sid:10122299; rev:1; classtype:misc-activity;)