-
Notifications
You must be signed in to change notification settings - Fork 18
/
dyndns-tls.rules
2300 lines (2300 loc) · 714 KB
/
dyndns-tls.rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain flashserv.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".flashserv.net"; fast_pattern; distance:-14; within:14; sid:10120000; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain flashserv.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".flashserv.net"; fast_pattern; distance:-14; within:14; sid:10120001; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain xns01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".xns01.com"; fast_pattern; distance:-10; within:10; sid:10120002; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain xns01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".xns01.com"; fast_pattern; distance:-10; within:10; sid:10120003; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsdynamic.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdynamic.net"; fast_pattern; distance:-15; within:15; sid:10120004; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsdynamic.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdynamic.net"; fast_pattern; distance:-15; within:15; sid:10120005; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsget.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsget.org"; fast_pattern; distance:-11; within:11; sid:10120006; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsget.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsget.org"; fast_pattern; distance:-11; within:11; sid:10120007; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain proxy8080.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".proxy8080.com"; fast_pattern; distance:-14; within:14; sid:10120008; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain proxy8080.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".proxy8080.com"; fast_pattern; distance:-14; within:14; sid:10120009; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain mysq1.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysq1.net"; fast_pattern; distance:-10; within:10; sid:10120010; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain mysq1.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysq1.net"; fast_pattern; distance:-10; within:10; sid:10120011; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".http01.com"; fast_pattern; distance:-11; within:11; sid:10120012; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".http01.com"; fast_pattern; distance:-11; within:11; sid:10120013; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ssh01.com"; fast_pattern; distance:-10; within:10; sid:10120014; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ssh01.com"; fast_pattern; distance:-10; within:10; sid:10120015; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain user32.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".user32.com"; fast_pattern; distance:-11; within:11; sid:10120016; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain user32.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".user32.com"; fast_pattern; distance:-11; within:11; sid:10120017; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ttl60.com"; fast_pattern; distance:-10; within:10; sid:10120018; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ttl60.com"; fast_pattern; distance:-10; within:10; sid:10120019; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ddns01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns01.com"; fast_pattern; distance:-11; within:11; sid:10120020; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ddns01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns01.com"; fast_pattern; distance:-11; within:11; sid:10120021; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain fe100.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fe100.net"; fast_pattern; distance:-10; within:10; sid:10120022; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain fe100.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fe100.net"; fast_pattern; distance:-10; within:10; sid:10120023; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain imap01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".imap01.com"; fast_pattern; distance:-11; within:11; sid:10120024; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain imap01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".imap01.com"; fast_pattern; distance:-11; within:11; sid:10120025; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain craftx.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".craftx.biz"; fast_pattern; distance:-11; within:11; sid:10120026; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain craftx.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".craftx.biz"; fast_pattern; distance:-11; within:11; sid:10120027; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ns360.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ns360.info"; fast_pattern; distance:-11; within:11; sid:10120028; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ns360.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ns360.info"; fast_pattern; distance:-11; within:11; sid:10120029; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ttl60.org"; fast_pattern; distance:-10; within:10; sid:10120030; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ttl60.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ttl60.org"; fast_pattern; distance:-10; within:10; sid:10120031; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain x64.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".x64.me"; fast_pattern; distance:-7; within:7; sid:10120032; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain x64.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".x64.me"; fast_pattern; distance:-7; within:7; sid:10120033; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tempors.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tempors.com"; fast_pattern; distance:-12; within:12; sid:10120034; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tempors.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tempors.com"; fast_pattern; distance:-12; within:12; sid:10120035; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain https443.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".https443.com"; fast_pattern; distance:-13; within:13; sid:10120036; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain https443.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".https443.com"; fast_pattern; distance:-13; within:13; sid:10120037; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tftpd.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".tftpd.net"; fast_pattern; distance:-10; within:10; sid:10120038; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain tftpd.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".tftpd.net"; fast_pattern; distance:-10; within:10; sid:10120039; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain wow64.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".wow64.net"; fast_pattern; distance:-10; within:10; sid:10120040; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain wow64.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".wow64.net"; fast_pattern; distance:-10; within:10; sid:10120041; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsapi.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsapi.info"; fast_pattern; distance:-12; within:12; sid:10120042; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsapi.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsapi.info"; fast_pattern; distance:-12; within:12; sid:10120043; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain kadm5.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kadm5.com"; fast_pattern; distance:-10; within:10; sid:10120044; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain kadm5.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kadm5.com"; fast_pattern; distance:-10; within:10; sid:10120045; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain voip01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".voip01.com"; fast_pattern; distance:-11; within:11; sid:10120046; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain voip01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".voip01.com"; fast_pattern; distance:-11; within:11; sid:10120047; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh22.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ssh22.net"; fast_pattern; distance:-10; within:10; sid:10120048; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ssh22.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ssh22.net"; fast_pattern; distance:-10; within:10; sid:10120049; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ftp21.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftp21.net"; fast_pattern; distance:-10; within:10; sid:10120050; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ftp21.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftp21.net"; fast_pattern; distance:-10; within:10; sid:10120051; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ntdll.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ntdll.net"; fast_pattern; distance:-10; within:10; sid:10120052; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ntdll.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ntdll.net"; fast_pattern; distance:-10; within:10; sid:10120053; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dns53.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dns53.biz"; fast_pattern; distance:-10; within:10; sid:10120054; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dns53.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dns53.biz"; fast_pattern; distance:-10; within:10; sid:10120055; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsd.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsd.info"; fast_pattern; distance:-10; within:10; sid:10120056; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain dnsd.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsd.info"; fast_pattern; distance:-10; within:10; sid:10120057; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain sql01.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sql01.com"; fast_pattern; distance:-10; within:10; sid:10120058; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain sql01.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sql01.com"; fast_pattern; distance:-10; within:10; sid:10120059; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ole32.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ole32.com"; fast_pattern; distance:-10; within:10; sid:10120060; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain ole32.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ole32.com"; fast_pattern; distance:-10; within:10; sid:10120061; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain adultdns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".adultdns.net"; fast_pattern; distance:-13; within:13; sid:10120062; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain adultdns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".adultdns.net"; fast_pattern; distance:-13; within:13; sid:10120063; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http80.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".http80.info"; fast_pattern; distance:-12; within:12; sid:10120064; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSDYNAMIC.ORG domain http80.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".http80.info"; fast_pattern; distance:-12; within:12; sid:10120065; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain blogsyte.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogsyte.com"; distance:-13; within:13; sid:10120066; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain blogsyte.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogsyte.com"; fast_pattern; distance:-13; within:13; sid:10120067; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain brasilia.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".brasilia.me"; distance:-12; within:12; sid:10120068; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain brasilia.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".brasilia.me"; fast_pattern; distance:-12; within:12; sid:10120069; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain cable-modem.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cable-modem.org"; distance:-16; within:16; sid:10120070; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain cable-modem.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cable-modem.org"; fast_pattern; distance:-16; within:16; sid:10120071; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ciscofreak.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ciscofreak.com"; distance:-15; within:15; sid:10120072; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ciscofreak.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ciscofreak.com"; fast_pattern; distance:-15; within:15; sid:10120073; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain collegefan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".collegefan.org"; distance:-15; within:15; sid:10120074; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain collegefan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".collegefan.org"; fast_pattern; distance:-15; within:15; sid:10120075; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain couchpotatofries.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".couchpotatofries.org"; distance:-21; within:21; sid:10120076; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain couchpotatofries.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".couchpotatofries.org"; fast_pattern; distance:-21; within:21; sid:10120077; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain damnserver.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".damnserver.com"; distance:-15; within:15; sid:10120078; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain damnserver.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".damnserver.com"; fast_pattern; distance:-15; within:15; sid:10120079; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.me"; distance:-8; within:8; sid:10120080; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.me"; fast_pattern; distance:-8; within:8; sid:10120081; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ditchyourip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ditchyourip.com"; distance:-16; within:16; sid:10120082; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ditchyourip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ditchyourip.com"; fast_pattern; distance:-16; within:16; sid:10120083; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsfor.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsfor.me"; distance:-10; within:10; sid:10120084; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsfor.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsfor.me"; fast_pattern; distance:-10; within:10; sid:10120085; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsiskinky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsiskinky.com"; distance:-15; within:15; sid:10120086; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dnsiskinky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsiskinky.com"; fast_pattern; distance:-15; within:15; sid:10120087; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dvrcam.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dvrcam.info"; distance:-12; within:12; sid:10120088; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dvrcam.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dvrcam.info"; fast_pattern; distance:-12; within:12; sid:10120089; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dynns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynns.com"; distance:-10; within:10; sid:10120090; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain dynns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynns.com"; fast_pattern; distance:-10; within:10; sid:10120091; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain eating-organic.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".eating-organic.net"; distance:-19; within:19; sid:10120092; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain eating-organic.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".eating-organic.net"; fast_pattern; distance:-19; within:19; sid:10120093; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain fantasyleague.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fantasyleague.cc"; distance:-17; within:17; sid:10120094; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain fantasyleague.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fantasyleague.cc"; fast_pattern; distance:-17; within:17; sid:10120095; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain geekgalaxy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".geekgalaxy.com"; distance:-15; within:15; sid:10120096; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain geekgalaxy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".geekgalaxy.com"; fast_pattern; distance:-15; within:15; sid:10120097; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain golffan.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".golffan.us"; distance:-11; within:11; sid:10120098; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain golffan.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".golffan.us"; fast_pattern; distance:-11; within:11; sid:10120099; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain health-carereform.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".health-carereform.com"; distance:-22; within:22; sid:10120100; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain health-carereform.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".health-carereform.com"; fast_pattern; distance:-22; within:22; sid:10120101; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritymac.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homesecuritymac.com"; distance:-20; within:20; sid:10120102; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritymac.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homesecuritymac.com"; fast_pattern; distance:-20; within:20; sid:10120103; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritypc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homesecuritypc.com"; distance:-19; within:19; sid:10120104; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain homesecuritypc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homesecuritypc.com"; fast_pattern; distance:-19; within:19; sid:10120105; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hopto.me"; distance:-9; within:9; sid:10120106; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hopto.me"; fast_pattern; distance:-9; within:9; sid:10120107; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ilovecollege.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ilovecollege.info"; distance:-18; within:18; sid:10120108; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ilovecollege.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ilovecollege.info"; fast_pattern; distance:-18; within:18; sid:10120109; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain loginto.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".loginto.me"; distance:-11; within:11; sid:10120110; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain loginto.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".loginto.me"; fast_pattern; distance:-11; within:11; sid:10120111; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mlbfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mlbfan.org"; distance:-11; within:11; sid:10120112; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mlbfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mlbfan.org"; fast_pattern; distance:-11; within:11; sid:10120113; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mmafan.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mmafan.biz"; distance:-11; within:11; sid:10120114; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mmafan.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mmafan.biz"; fast_pattern; distance:-11; within:11; sid:10120115; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myactivedirectory.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myactivedirectory.com"; distance:-22; within:22; sid:10120116; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myactivedirectory.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myactivedirectory.com"; fast_pattern; distance:-22; within:22; sid:10120117; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mydissent.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mydissent.net"; distance:-14; within:14; sid:10120118; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mydissent.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mydissent.net"; fast_pattern; distance:-14; within:14; sid:10120119; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myeffect.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myeffect.net"; distance:-13; within:13; sid:10120120; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myeffect.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myeffect.net"; fast_pattern; distance:-13; within:13; sid:10120121; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mymediapc.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mymediapc.net"; distance:-14; within:14; sid:10120122; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mymediapc.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mymediapc.net"; fast_pattern; distance:-14; within:14; sid:10120123; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mypsx.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypsx.net"; distance:-10; within:10; sid:10120124; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mypsx.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypsx.net"; fast_pattern; distance:-10; within:10; sid:10120125; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecuritycamera.com"; distance:-21; within:21; sid:10120126; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecuritycamera.com"; fast_pattern; distance:-21; within:21; sid:10120127; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecuritycamera.net"; distance:-21; within:21; sid:10120128; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecuritycamera.net"; fast_pattern; distance:-21; within:21; sid:10120129; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mysecuritycamera.org"; distance:-21; within:21; sid:10120130; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain mysecuritycamera.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mysecuritycamera.org"; fast_pattern; distance:-21; within:21; sid:10120131; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain net-freaks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".net-freaks.com"; distance:-15; within:15; sid:10120132; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain net-freaks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".net-freaks.com"; fast_pattern; distance:-15; within:15; sid:10120133; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nflfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nflfan.org"; distance:-11; within:11; sid:10120134; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nflfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nflfan.org"; fast_pattern; distance:-11; within:11; sid:10120135; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nhlfan.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nhlfan.net"; distance:-11; within:11; sid:10120136; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain nhlfan.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nhlfan.net"; fast_pattern; distance:-11; within:11; sid:10120137; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.ca"; distance:-9; within:9; sid:10120138; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.ca"; fast_pattern; distance:-9; within:9; sid:10120139; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.co.uk"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.co.uk"; distance:-12; within:12; sid:10120140; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.co.uk in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.co.uk"; fast_pattern; distance:-12; within:12; sid:10120141; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.net"; distance:-10; within:10; sid:10120142; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.net"; fast_pattern; distance:-10; within:10; sid:10120143; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".noip.us"; distance:-8; within:8; sid:10120144; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".noip.us"; fast_pattern; distance:-8; within:8; sid:10120145; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pgafan.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pgafan.net"; distance:-11; within:11; sid:10120146; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pgafan.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pgafan.net"; fast_pattern; distance:-11; within:11; sid:10120147; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain point2this.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".point2this.com"; distance:-15; within:15; sid:10120148; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain point2this.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".point2this.com"; fast_pattern; distance:-15; within:15; sid:10120149; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pointto.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pointto.us"; distance:-11; within:11; sid:10120150; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain pointto.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pointto.us"; fast_pattern; distance:-11; within:11; sid:10120151; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain privatizehealthinsurance.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".privatizehealthinsurance.net"; distance:-29; within:29; sid:10120152; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain privatizehealthinsurance.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".privatizehealthinsurance.net"; fast_pattern; distance:-29; within:29; sid:10120153; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain quicksytes.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".quicksytes.com"; distance:-15; within:15; sid:10120154; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain quicksytes.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".quicksytes.com"; fast_pattern; distance:-15; within:15; sid:10120155; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain read-books.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".read-books.org"; distance:-15; within:15; sid:10120156; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain read-books.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".read-books.org"; fast_pattern; distance:-15; within:15; sid:10120157; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securityexploits.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".securityexploits.com"; distance:-21; within:21; sid:10120158; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securityexploits.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".securityexploits.com"; fast_pattern; distance:-21; within:21; sid:10120159; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securitytactics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".securitytactics.com"; distance:-20; within:20; sid:10120160; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain securitytactics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".securitytactics.com"; fast_pattern; distance:-20; within:20; sid:10120161; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveexchange.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveexchange.com"; distance:-18; within:18; sid:10120162; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveexchange.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveexchange.com"; fast_pattern; distance:-18; within:18; sid:10120163; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehumour.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servehumour.com"; distance:-16; within:16; sid:10120164; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehumour.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servehumour.com"; fast_pattern; distance:-16; within:16; sid:10120165; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servep2p.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servep2p.com"; distance:-13; within:13; sid:10120166; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servep2p.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servep2p.com"; fast_pattern; distance:-13; within:13; sid:10120167; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servesarcasm.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servesarcasm.com"; distance:-17; within:17; sid:10120168; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servesarcasm.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servesarcasm.com"; fast_pattern; distance:-17; within:17; sid:10120169; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain stufftoread.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stufftoread.com"; distance:-16; within:16; sid:10120170; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain stufftoread.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stufftoread.com"; fast_pattern; distance:-16; within:16; sid:10120171; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ufcfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ufcfan.org"; distance:-11; within:11; sid:10120172; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ufcfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ufcfan.org"; fast_pattern; distance:-11; within:11; sid:10120173; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain unusualperson.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".unusualperson.com"; distance:-18; within:18; sid:10120174; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain unusualperson.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".unusualperson.com"; fast_pattern; distance:-18; within:18; sid:10120175; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain workisboring.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".workisboring.com"; distance:-17; within:17; sid:10120176; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain workisboring.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".workisboring.com"; fast_pattern; distance:-17; within:17; sid:10120177; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain 3utilities.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3utilities.com"; distance:-15; within:15; sid:10120178; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain 3utilities.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3utilities.com"; fast_pattern; distance:-15; within:15; sid:10120179; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain bounceme.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bounceme.net"; distance:-13; within:13; sid:10120180; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain bounceme.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bounceme.net"; fast_pattern; distance:-13; within:13; sid:10120181; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddns.net"; distance:-9; within:9; sid:10120182; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddns.net"; fast_pattern; distance:-9; within:9; sid:10120183; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddnsking.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ddnsking.com"; distance:-13; within:13; sid:10120184; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain ddnsking.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ddnsking.com"; fast_pattern; distance:-13; within:13; sid:10120185; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain gotdns.ch"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotdns.ch"; distance:-10; within:10; sid:10120186; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain gotdns.ch in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotdns.ch"; fast_pattern; distance:-10; within:10; sid:10120187; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hopto.org"; distance:-10; within:10; sid:10120188; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain hopto.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hopto.org"; fast_pattern; distance:-10; within:10; sid:10120189; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myftp.biz"; distance:-10; within:10; sid:10120190; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myftp.biz"; fast_pattern; distance:-10; within:10; sid:10120191; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myftp.org"; distance:-10; within:10; sid:10120192; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myftp.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myftp.org"; fast_pattern; distance:-10; within:10; sid:10120193; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myvnc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myvnc.com"; distance:-10; within:10; sid:10120194; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain myvnc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myvnc.com"; fast_pattern; distance:-10; within:10; sid:10120195; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.biz"; distance:-10; within:10; sid:10120196; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.biz"; fast_pattern; distance:-10; within:10; sid:10120197; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.info"; distance:-11; within:11; sid:10120198; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.info"; fast_pattern; distance:-11; within:11; sid:10120199; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".no-ip.org"; distance:-10; within:10; sid:10120200; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain no-ip.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".no-ip.org"; fast_pattern; distance:-10; within:10; sid:10120201; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".noip.me"; distance:-8; within:8; sid:10120202; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain noip.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".noip.me"; fast_pattern; distance:-8; within:8; sid:10120203; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain redirectme.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".redirectme.net"; distance:-15; within:15; sid:10120204; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain redirectme.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".redirectme.net"; fast_pattern; distance:-15; within:15; sid:10120205; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servebeer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebeer.com"; distance:-14; within:14; sid:10120206; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servebeer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebeer.com"; fast_pattern; distance:-14; within:14; sid:10120207; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveblog.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveblog.net"; distance:-14; within:14; sid:10120208; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveblog.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveblog.net"; fast_pattern; distance:-14; within:14; sid:10120209; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servecounterstrike.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servecounterstrike.com"; distance:-23; within:23; sid:10120210; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servecounterstrike.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servecounterstrike.com"; fast_pattern; distance:-23; within:23; sid:10120211; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveftp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveftp.com"; distance:-13; within:13; sid:10120212; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveftp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveftp.com"; fast_pattern; distance:-13; within:13; sid:10120213; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servegame.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servegame.com"; distance:-14; within:14; sid:10120214; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servegame.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servegame.com"; fast_pattern; distance:-14; within:14; sid:10120215; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehalflife.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servehalflife.com"; distance:-18; within:18; sid:10120216; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehalflife.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servehalflife.com"; fast_pattern; distance:-18; within:18; sid:10120217; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehttp.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servehttp.com"; distance:-14; within:14; sid:10120218; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servehttp.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servehttp.com"; fast_pattern; distance:-14; within:14; sid:10120219; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveminecraft.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveminecraft.net"; distance:-19; within:19; sid:10120220; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain serveminecraft.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveminecraft.net"; fast_pattern; distance:-19; within:19; sid:10120221; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servemp3.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servemp3.com"; distance:-13; within:13; sid:10120222; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servemp3.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servemp3.com"; fast_pattern; distance:-13; within:13; sid:10120223; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servepics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servepics.com"; distance:-14; within:14; sid:10120224; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servepics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servepics.com"; fast_pattern; distance:-14; within:14; sid:10120225; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servequake.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servequake.com"; distance:-15; within:15; sid:10120226; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain servequake.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servequake.com"; fast_pattern; distance:-15; within:15; sid:10120227; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain sytes.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sytes.net"; distance:-10; within:10; sid:10120228; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain sytes.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sytes.net"; fast_pattern; distance:-10; within:10; sid:10120229; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain webhop.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.me"; distance:-10; within:10; sid:10120230; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain webhop.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.me"; fast_pattern; distance:-10; within:10; sid:10120231; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain zapto.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zapto.org"; distance:-10; within:10; sid:10120232; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for NOIP domain zapto.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zapto.org"; fast_pattern; distance:-10; within:10; sid:10120233; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain at-band-camp.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".at-band-camp.net"; fast_pattern; distance:-17; within:17; sid:10120234; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain at-band-camp.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".at-band-camp.net"; fast_pattern; distance:-17; within:17; sid:10120235; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrel-of-knowledge.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".barrel-of-knowledge.info"; fast_pattern; distance:-25; within:25; sid:10120236; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrel-of-knowledge.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".barrel-of-knowledge.info"; fast_pattern; distance:-25; within:25; sid:10120237; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrell-of-knowledge.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".barrell-of-knowledge.info"; fast_pattern; distance:-26; within:26; sid:10120238; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain barrell-of-knowledge.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".barrell-of-knowledge.info"; fast_pattern; distance:-26; within:26; sid:10120239; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain better-than.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".better-than.tv"; fast_pattern; distance:-15; within:15; sid:10120240; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain better-than.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".better-than.tv"; fast_pattern; distance:-15; within:15; sid:10120241; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogdns.com"; fast_pattern; distance:-12; within:12; sid:10120242; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogdns.com"; fast_pattern; distance:-12; within:12; sid:10120243; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogdns.net"; fast_pattern; distance:-12; within:12; sid:10120244; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogdns.net"; fast_pattern; distance:-12; within:12; sid:10120245; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogdns.org"; fast_pattern; distance:-12; within:12; sid:10120246; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogdns.org"; fast_pattern; distance:-12; within:12; sid:10120247; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogsite.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".blogsite.org"; fast_pattern; distance:-13; within:13; sid:10120248; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain blogsite.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".blogsite.org"; fast_pattern; distance:-13; within:13; sid:10120249; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain boldlygoingnowhere.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".boldlygoingnowhere.org"; fast_pattern; distance:-23; within:23; sid:10120250; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain boldlygoingnowhere.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".boldlygoingnowhere.org"; fast_pattern; distance:-23; within:23; sid:10120251; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain broke-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".broke-it.net"; fast_pattern; distance:-13; within:13; sid:10120252; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain broke-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".broke-it.net"; fast_pattern; distance:-13; within:13; sid:10120253; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain buyshouses.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".buyshouses.net"; fast_pattern; distance:-15; within:15; sid:10120254; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain buyshouses.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".buyshouses.net"; fast_pattern; distance:-15; within:15; sid:10120255; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain cechire.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cechire.com"; fast_pattern; distance:-12; within:12; sid:10120256; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain cechire.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cechire.com"; fast_pattern; distance:-12; within:12; sid:10120257; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.com"; fast_pattern; distance:-13; within:13; sid:10120258; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.com"; fast_pattern; distance:-13; within:13; sid:10120259; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.net"; fast_pattern; distance:-13; within:13; sid:10120260; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.net"; fast_pattern; distance:-13; within:13; sid:10120261; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsalias.org"; fast_pattern; distance:-13; within:13; sid:10120262; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsalias.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsalias.org"; fast_pattern; distance:-13; within:13; sid:10120263; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdojo.com"; fast_pattern; distance:-12; within:12; sid:10120264; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdojo.com"; fast_pattern; distance:-12; within:12; sid:10120265; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdojo.net"; fast_pattern; distance:-12; within:12; sid:10120266; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdojo.net"; fast_pattern; distance:-12; within:12; sid:10120267; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dnsdojo.org"; fast_pattern; distance:-12; within:12; sid:10120268; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dnsdojo.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dnsdojo.org"; fast_pattern; distance:-12; within:12; sid:10120269; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain does-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".does-it.net"; fast_pattern; distance:-12; within:12; sid:10120270; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain does-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".does-it.net"; fast_pattern; distance:-12; within:12; sid:10120271; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doesntexist.com"; fast_pattern; distance:-16; within:16; sid:10120272; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doesntexist.com"; fast_pattern; distance:-16; within:16; sid:10120273; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doesntexist.org"; fast_pattern; distance:-16; within:16; sid:10120274; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doesntexist.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doesntexist.org"; fast_pattern; distance:-16; within:16; sid:10120275; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dontexist.com"; fast_pattern; distance:-14; within:14; sid:10120276; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dontexist.com"; fast_pattern; distance:-14; within:14; sid:10120277; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dontexist.net"; fast_pattern; distance:-14; within:14; sid:10120278; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dontexist.net"; fast_pattern; distance:-14; within:14; sid:10120279; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dontexist.org"; fast_pattern; distance:-14; within:14; sid:10120280; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dontexist.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dontexist.org"; fast_pattern; distance:-14; within:14; sid:10120281; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doomdns.com"; fast_pattern; distance:-12; within:12; sid:10120282; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doomdns.com"; fast_pattern; distance:-12; within:12; sid:10120283; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".doomdns.org"; fast_pattern; distance:-12; within:12; sid:10120284; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain doomdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".doomdns.org"; fast_pattern; distance:-12; within:12; sid:10120285; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dvrdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dvrdns.org"; fast_pattern; distance:-11; within:11; sid:10120286; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dvrdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dvrdns.org"; fast_pattern; distance:-11; within:11; sid:10120287; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyn-o-saur.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyn-o-saur.com"; fast_pattern; distance:-15; within:15; sid:10120288; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyn-o-saur.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyn-o-saur.com"; fast_pattern; distance:-15; within:15; sid:10120289; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynalias.com"; fast_pattern; distance:-13; within:13; sid:10120290; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynalias.com"; fast_pattern; distance:-13; within:13; sid:10120291; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynalias.net"; fast_pattern; distance:-13; within:13; sid:10120292; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynalias.net"; fast_pattern; distance:-13; within:13; sid:10120293; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynalias.org"; fast_pattern; distance:-13; within:13; sid:10120294; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynalias.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynalias.org"; fast_pattern; distance:-13; within:13; sid:10120295; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynathome.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynathome.net"; fast_pattern; distance:-14; within:14; sid:10120296; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dynathome.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynathome.net"; fast_pattern; distance:-14; within:14; sid:10120297; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-home.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-at-home.com"; fast_pattern; distance:-19; within:19; sid:10120298; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-home.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-at-home.com"; fast_pattern; distance:-19; within:19; sid:10120299; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-work.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-at-work.com"; fast_pattern; distance:-19; within:19; sid:10120300; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-at-work.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-at-work.com"; fast_pattern; distance:-19; within:19; sid:10120301; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-blog.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-blog.com"; fast_pattern; distance:-16; within:16; sid:10120302; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-blog.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-blog.com"; fast_pattern; distance:-16; within:16; sid:10120303; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-free.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-free.com"; fast_pattern; distance:-16; within:16; sid:10120304; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-free.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-free.com"; fast_pattern; distance:-16; within:16; sid:10120305; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-home.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-home.com"; fast_pattern; distance:-16; within:16; sid:10120306; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-home.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-home.com"; fast_pattern; distance:-16; within:16; sid:10120307; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-ip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-ip.com"; fast_pattern; distance:-14; within:14; sid:10120308; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-ip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-ip.com"; fast_pattern; distance:-14; within:14; sid:10120309; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-mail.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-mail.com"; fast_pattern; distance:-16; within:16; sid:10120310; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-mail.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-mail.com"; fast_pattern; distance:-16; within:16; sid:10120311; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-office.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-office.com"; fast_pattern; distance:-18; within:18; sid:10120312; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-office.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-office.com"; fast_pattern; distance:-18; within:18; sid:10120313; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-pics.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-pics.com"; fast_pattern; distance:-16; within:16; sid:10120314; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-pics.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-pics.com"; fast_pattern; distance:-16; within:16; sid:10120315; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-remote.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-remote.com"; fast_pattern; distance:-18; within:18; sid:10120316; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-remote.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-remote.com"; fast_pattern; distance:-18; within:18; sid:10120317; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-server.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-server.com"; fast_pattern; distance:-18; within:18; sid:10120318; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-server.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-server.com"; fast_pattern; distance:-18; within:18; sid:10120319; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-web.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-web.com"; fast_pattern; distance:-15; within:15; sid:10120320; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-web.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-web.com"; fast_pattern; distance:-15; within:15; sid:10120321; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-wiki.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-wiki.com"; fast_pattern; distance:-16; within:16; sid:10120322; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-wiki.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-wiki.com"; fast_pattern; distance:-16; within:16; sid:10120323; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-work.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns-work.com"; fast_pattern; distance:-16; within:16; sid:10120324; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns-work.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns-work.com"; fast_pattern; distance:-16; within:16; sid:10120325; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.biz"; fast_pattern; distance:-11; within:11; sid:10120326; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.biz"; fast_pattern; distance:-11; within:11; sid:10120327; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.info"; fast_pattern; distance:-12; within:12; sid:10120328; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.info"; fast_pattern; distance:-12; within:12; sid:10120329; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.org"; fast_pattern; distance:-11; within:11; sid:10120330; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.org"; fast_pattern; distance:-11; within:11; sid:10120331; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.tv"; fast_pattern; distance:-10; within:10; sid:10120332; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.tv"; fast_pattern; distance:-10; within:10; sid:10120333; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.ws"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dyndns.ws"; fast_pattern; distance:-10; within:10; sid:10120334; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain dyndns.ws in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dyndns.ws"; fast_pattern; distance:-10; within:10; sid:10120335; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endofinternet.net"; fast_pattern; distance:-18; within:18; sid:10120336; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endofinternet.net"; fast_pattern; distance:-18; within:18; sid:10120337; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endofinternet.org"; fast_pattern; distance:-18; within:18; sid:10120338; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endofinternet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endofinternet.org"; fast_pattern; distance:-18; within:18; sid:10120339; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endoftheinternet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".endoftheinternet.org"; fast_pattern; distance:-21; within:21; sid:10120340; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain endoftheinternet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".endoftheinternet.org"; fast_pattern; distance:-21; within:21; sid:10120341; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-maison.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-a-la-maison.com"; fast_pattern; distance:-20; within:20; sid:10120342; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-maison.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-a-la-maison.com"; fast_pattern; distance:-20; within:20; sid:10120343; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-masion.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-a-la-masion.com"; fast_pattern; distance:-20; within:20; sid:10120344; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-a-la-masion.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-a-la-masion.com"; fast_pattern; distance:-20; within:20; sid:10120345; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-le-patron.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-le-patron.com"; fast_pattern; distance:-18; within:18; sid:10120346; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-le-patron.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-le-patron.com"; fast_pattern; distance:-18; within:18; sid:10120347; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-mon-blogueur.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".est-mon-blogueur.com"; fast_pattern; distance:-21; within:21; sid:10120348; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain est-mon-blogueur.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".est-mon-blogueur.com"; fast_pattern; distance:-21; within:21; sid:10120349; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-better.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-better.biz"; fast_pattern; distance:-15; within:15; sid:10120350; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-better.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-better.biz"; fast_pattern; distance:-15; within:15; sid:10120351; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-more.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-more.biz"; fast_pattern; distance:-13; within:13; sid:10120352; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-more.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-more.biz"; fast_pattern; distance:-13; within:13; sid:10120353; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-our.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-our.info"; fast_pattern; distance:-13; within:13; sid:10120354; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-our.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-our.info"; fast_pattern; distance:-13; within:13; sid:10120355; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-some.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-some.biz"; fast_pattern; distance:-13; within:13; sid:10120356; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-some.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-some.biz"; fast_pattern; distance:-13; within:13; sid:10120357; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-the.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".for-the.biz"; fast_pattern; distance:-12; within:12; sid:10120358; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain for-the.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".for-the.biz"; fast_pattern; distance:-12; within:12; sid:10120359; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.her.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".forgot.her.name"; fast_pattern; distance:-16; within:16; sid:10120360; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.her.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".forgot.her.name"; fast_pattern; distance:-16; within:16; sid:10120361; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.his.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".forgot.his.name"; fast_pattern; distance:-16; within:16; sid:10120362; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain forgot.his.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".forgot.his.name"; fast_pattern; distance:-16; within:16; sid:10120363; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ak.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ak.com"; fast_pattern; distance:-12; within:12; sid:10120364; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ak.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ak.com"; fast_pattern; distance:-12; within:12; sid:10120365; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-al.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-al.com"; fast_pattern; distance:-12; within:12; sid:10120366; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-al.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-al.com"; fast_pattern; distance:-12; within:12; sid:10120367; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ar.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ar.com"; fast_pattern; distance:-12; within:12; sid:10120368; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ar.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ar.com"; fast_pattern; distance:-12; within:12; sid:10120369; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-az.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-az.net"; fast_pattern; distance:-12; within:12; sid:10120370; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-az.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-az.net"; fast_pattern; distance:-12; within:12; sid:10120371; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ca.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ca.com"; fast_pattern; distance:-12; within:12; sid:10120372; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ca.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ca.com"; fast_pattern; distance:-12; within:12; sid:10120373; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-co.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-co.net"; fast_pattern; distance:-12; within:12; sid:10120374; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-co.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-co.net"; fast_pattern; distance:-12; within:12; sid:10120375; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ct.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ct.com"; fast_pattern; distance:-12; within:12; sid:10120376; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ct.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ct.com"; fast_pattern; distance:-12; within:12; sid:10120377; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-dc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-dc.com"; fast_pattern; distance:-12; within:12; sid:10120378; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-dc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-dc.com"; fast_pattern; distance:-12; within:12; sid:10120379; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-de.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-de.com"; fast_pattern; distance:-12; within:12; sid:10120380; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-de.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-de.com"; fast_pattern; distance:-12; within:12; sid:10120381; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-fl.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-fl.com"; fast_pattern; distance:-12; within:12; sid:10120382; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-fl.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-fl.com"; fast_pattern; distance:-12; within:12; sid:10120383; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ga.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ga.com"; fast_pattern; distance:-12; within:12; sid:10120384; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ga.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ga.com"; fast_pattern; distance:-12; within:12; sid:10120385; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-hi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-hi.com"; fast_pattern; distance:-12; within:12; sid:10120386; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-hi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-hi.com"; fast_pattern; distance:-12; within:12; sid:10120387; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ia.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ia.com"; fast_pattern; distance:-12; within:12; sid:10120388; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ia.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ia.com"; fast_pattern; distance:-12; within:12; sid:10120389; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-id.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-id.com"; fast_pattern; distance:-12; within:12; sid:10120390; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-id.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-id.com"; fast_pattern; distance:-12; within:12; sid:10120391; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-il.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-il.com"; fast_pattern; distance:-12; within:12; sid:10120392; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-il.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-il.com"; fast_pattern; distance:-12; within:12; sid:10120393; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-in.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-in.com"; fast_pattern; distance:-12; within:12; sid:10120394; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-in.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-in.com"; fast_pattern; distance:-12; within:12; sid:10120395; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ks.com"; fast_pattern; distance:-12; within:12; sid:10120396; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ks.com"; fast_pattern; distance:-12; within:12; sid:10120397; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ky.com"; fast_pattern; distance:-12; within:12; sid:10120398; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ky.com"; fast_pattern; distance:-12; within:12; sid:10120399; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-la.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-la.net"; fast_pattern; distance:-12; within:12; sid:10120400; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-la.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-la.net"; fast_pattern; distance:-12; within:12; sid:10120401; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ma.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ma.com"; fast_pattern; distance:-12; within:12; sid:10120402; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ma.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ma.com"; fast_pattern; distance:-12; within:12; sid:10120403; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-md.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-md.com"; fast_pattern; distance:-12; within:12; sid:10120404; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-md.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-md.com"; fast_pattern; distance:-12; within:12; sid:10120405; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-me.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-me.org"; fast_pattern; distance:-12; within:12; sid:10120406; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-me.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-me.org"; fast_pattern; distance:-12; within:12; sid:10120407; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mi.com"; fast_pattern; distance:-12; within:12; sid:10120408; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mi.com"; fast_pattern; distance:-12; within:12; sid:10120409; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mn.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mn.com"; fast_pattern; distance:-12; within:12; sid:10120410; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mn.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mn.com"; fast_pattern; distance:-12; within:12; sid:10120411; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mo.com"; fast_pattern; distance:-12; within:12; sid:10120412; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mo.com"; fast_pattern; distance:-12; within:12; sid:10120413; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ms.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ms.com"; fast_pattern; distance:-12; within:12; sid:10120414; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ms.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ms.com"; fast_pattern; distance:-12; within:12; sid:10120415; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mt.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-mt.com"; fast_pattern; distance:-12; within:12; sid:10120416; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-mt.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-mt.com"; fast_pattern; distance:-12; within:12; sid:10120417; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nc.com"; fast_pattern; distance:-12; within:12; sid:10120418; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nc.com"; fast_pattern; distance:-12; within:12; sid:10120419; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nd.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nd.com"; fast_pattern; distance:-12; within:12; sid:10120420; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nd.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nd.com"; fast_pattern; distance:-12; within:12; sid:10120421; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ne.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ne.com"; fast_pattern; distance:-12; within:12; sid:10120422; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ne.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ne.com"; fast_pattern; distance:-12; within:12; sid:10120423; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nh.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nh.com"; fast_pattern; distance:-12; within:12; sid:10120424; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nh.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nh.com"; fast_pattern; distance:-12; within:12; sid:10120425; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nj.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nj.com"; fast_pattern; distance:-12; within:12; sid:10120426; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nj.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nj.com"; fast_pattern; distance:-12; within:12; sid:10120427; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nm.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nm.com"; fast_pattern; distance:-12; within:12; sid:10120428; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nm.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nm.com"; fast_pattern; distance:-12; within:12; sid:10120429; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-nv.com"; fast_pattern; distance:-12; within:12; sid:10120430; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-nv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-nv.com"; fast_pattern; distance:-12; within:12; sid:10120431; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ny.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ny.net"; fast_pattern; distance:-12; within:12; sid:10120432; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ny.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ny.net"; fast_pattern; distance:-12; within:12; sid:10120433; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-oh.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-oh.com"; fast_pattern; distance:-12; within:12; sid:10120434; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-oh.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-oh.com"; fast_pattern; distance:-12; within:12; sid:10120435; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ok.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ok.com"; fast_pattern; distance:-12; within:12; sid:10120436; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ok.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ok.com"; fast_pattern; distance:-12; within:12; sid:10120437; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-or.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-or.com"; fast_pattern; distance:-12; within:12; sid:10120438; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-or.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-or.com"; fast_pattern; distance:-12; within:12; sid:10120439; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pa.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-pa.com"; fast_pattern; distance:-12; within:12; sid:10120440; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pa.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-pa.com"; fast_pattern; distance:-12; within:12; sid:10120441; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pr.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-pr.com"; fast_pattern; distance:-12; within:12; sid:10120442; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-pr.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-pr.com"; fast_pattern; distance:-12; within:12; sid:10120443; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ri.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ri.com"; fast_pattern; distance:-12; within:12; sid:10120444; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ri.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ri.com"; fast_pattern; distance:-12; within:12; sid:10120445; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sc.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-sc.com"; fast_pattern; distance:-12; within:12; sid:10120446; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sc.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-sc.com"; fast_pattern; distance:-12; within:12; sid:10120447; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sd.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-sd.com"; fast_pattern; distance:-12; within:12; sid:10120448; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-sd.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-sd.com"; fast_pattern; distance:-12; within:12; sid:10120449; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tn.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-tn.com"; fast_pattern; distance:-12; within:12; sid:10120450; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tn.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-tn.com"; fast_pattern; distance:-12; within:12; sid:10120451; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tx.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-tx.com"; fast_pattern; distance:-12; within:12; sid:10120452; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-tx.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-tx.com"; fast_pattern; distance:-12; within:12; sid:10120453; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ut.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-ut.com"; fast_pattern; distance:-12; within:12; sid:10120454; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-ut.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-ut.com"; fast_pattern; distance:-12; within:12; sid:10120455; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-va.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-va.com"; fast_pattern; distance:-12; within:12; sid:10120456; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-va.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-va.com"; fast_pattern; distance:-12; within:12; sid:10120457; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-vt.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-vt.com"; fast_pattern; distance:-12; within:12; sid:10120458; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-vt.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-vt.com"; fast_pattern; distance:-12; within:12; sid:10120459; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wa.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wa.com"; fast_pattern; distance:-12; within:12; sid:10120460; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wa.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wa.com"; fast_pattern; distance:-12; within:12; sid:10120461; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wi.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wi.com"; fast_pattern; distance:-12; within:12; sid:10120462; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wi.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wi.com"; fast_pattern; distance:-12; within:12; sid:10120463; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wv.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wv.com"; fast_pattern; distance:-12; within:12; sid:10120464; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wv.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wv.com"; fast_pattern; distance:-12; within:12; sid:10120465; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".from-wy.com"; fast_pattern; distance:-12; within:12; sid:10120466; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain from-wy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".from-wy.com"; fast_pattern; distance:-12; within:12; sid:10120467; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ftpaccess.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftpaccess.cc"; fast_pattern; distance:-13; within:13; sid:10120468; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ftpaccess.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftpaccess.cc"; fast_pattern; distance:-13; within:13; sid:10120469; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain fuettertdasnetz.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fuettertdasnetz.de"; fast_pattern; distance:-19; within:19; sid:10120470; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain fuettertdasnetz.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fuettertdasnetz.de"; fast_pattern; distance:-19; within:19; sid:10120471; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-host.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".game-host.org"; fast_pattern; distance:-14; within:14; sid:10120472; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-host.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".game-host.org"; fast_pattern; distance:-14; within:14; sid:10120473; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-server.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".game-server.cc"; fast_pattern; distance:-15; within:15; sid:10120474; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain game-server.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".game-server.cc"; fast_pattern; distance:-15; within:15; sid:10120475; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain getmyip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".getmyip.com"; fast_pattern; distance:-12; within:12; sid:10120476; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain getmyip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".getmyip.com"; fast_pattern; distance:-12; within:12; sid:10120477; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gets-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gets-it.net"; fast_pattern; distance:-12; within:12; sid:10120478; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gets-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gets-it.net"; fast_pattern; distance:-12; within:12; sid:10120479; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain go.dyndns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".go.dyndns.org"; fast_pattern; distance:-14; within:14; sid:10120480; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain go.dyndns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".go.dyndns.org"; fast_pattern; distance:-14; within:14; sid:10120481; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotdns.com"; fast_pattern; distance:-11; within:11; sid:10120482; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotdns.com"; fast_pattern; distance:-11; within:11; sid:10120483; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gotdns.org"; fast_pattern; distance:-11; within:11; sid:10120484; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain gotdns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gotdns.org"; fast_pattern; distance:-11; within:11; sid:10120485; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-the.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".groks-the.info"; fast_pattern; distance:-15; within:15; sid:10120486; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-the.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".groks-the.info"; fast_pattern; distance:-15; within:15; sid:10120487; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-this.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".groks-this.info"; fast_pattern; distance:-16; within:16; sid:10120488; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain groks-this.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".groks-this.info"; fast_pattern; distance:-16; within:16; sid:10120489; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ham-radio-op.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ham-radio-op.net"; fast_pattern; distance:-17; within:17; sid:10120490; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain ham-radio-op.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ham-radio-op.net"; fast_pattern; distance:-17; within:17; sid:10120491; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain here-for-more.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".here-for-more.info"; fast_pattern; distance:-19; within:19; sid:10120492; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain here-for-more.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".here-for-more.info"; fast_pattern; distance:-19; within:19; sid:10120493; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hobby-site.com"; fast_pattern; distance:-15; within:15; sid:10120494; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hobby-site.com"; fast_pattern; distance:-15; within:15; sid:10120495; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hobby-site.org"; fast_pattern; distance:-15; within:15; sid:10120496; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain hobby-site.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hobby-site.org"; fast_pattern; distance:-15; within:15; sid:10120497; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain home.dyndns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".home.dyndns.org"; fast_pattern; distance:-16; within:16; sid:10120498; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain home.dyndns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".home.dyndns.org"; fast_pattern; distance:-16; within:16; sid:10120499; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homedns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homedns.org"; fast_pattern; distance:-12; within:12; sid:10120500; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homedns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homedns.org"; fast_pattern; distance:-12; within:12; sid:10120501; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeftp.net"; fast_pattern; distance:-12; within:12; sid:10120502; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeftp.net"; fast_pattern; distance:-12; within:12; sid:10120503; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeftp.org"; fast_pattern; distance:-12; within:12; sid:10120504; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeftp.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeftp.org"; fast_pattern; distance:-12; within:12; sid:10120505; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeip.net"; fast_pattern; distance:-11; within:11; sid:10120506; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeip.net"; fast_pattern; distance:-11; within:11; sid:10120507; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinux.com"; fast_pattern; distance:-14; within:14; sid:10120508; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinux.com"; fast_pattern; distance:-14; within:14; sid:10120509; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinux.net"; fast_pattern; distance:-14; within:14; sid:10120510; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinux.net"; fast_pattern; distance:-14; within:14; sid:10120511; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homelinux.org"; fast_pattern; distance:-14; within:14; sid:10120512; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homelinux.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homelinux.org"; fast_pattern; distance:-14; within:14; sid:10120513; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeunix.com"; fast_pattern; distance:-13; within:13; sid:10120514; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeunix.com"; fast_pattern; distance:-13; within:13; sid:10120515; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeunix.net"; fast_pattern; distance:-13; within:13; sid:10120516; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeunix.net"; fast_pattern; distance:-13; within:13; sid:10120517; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homeunix.org"; fast_pattern; distance:-13; within:13; sid:10120518; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain homeunix.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homeunix.org"; fast_pattern; distance:-13; within:13; sid:10120519; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain iamallama.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iamallama.com"; fast_pattern; distance:-14; within:14; sid:10120520; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain iamallama.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iamallama.com"; fast_pattern; distance:-14; within:14; sid:10120521; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain in-the-band.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".in-the-band.net"; fast_pattern; distance:-16; within:16; sid:10120522; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain in-the-band.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".in-the-band.net"; fast_pattern; distance:-16; within:16; sid:10120523; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-anarchist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-anarchist.com"; fast_pattern; distance:-19; within:19; sid:10120524; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-anarchist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-anarchist.com"; fast_pattern; distance:-19; within:19; sid:10120525; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-blogger.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-blogger.com"; fast_pattern; distance:-17; within:17; sid:10120526; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-blogger.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-blogger.com"; fast_pattern; distance:-17; within:17; sid:10120527; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bookkeeper.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-bookkeeper.com"; fast_pattern; distance:-20; within:20; sid:10120528; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bookkeeper.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-bookkeeper.com"; fast_pattern; distance:-20; within:20; sid:10120529; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bruinsfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-bruinsfan.org"; fast_pattern; distance:-19; within:19; sid:10120530; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bruinsfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-bruinsfan.org"; fast_pattern; distance:-19; within:19; sid:10120531; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bulls-fan.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-bulls-fan.com"; fast_pattern; distance:-19; within:19; sid:10120532; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-bulls-fan.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-bulls-fan.com"; fast_pattern; distance:-19; within:19; sid:10120533; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-candidate.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-candidate.org"; fast_pattern; distance:-19; within:19; sid:10120534; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-candidate.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-candidate.org"; fast_pattern; distance:-19; within:19; sid:10120535; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-caterer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-caterer.com"; fast_pattern; distance:-17; within:17; sid:10120536; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-caterer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-caterer.com"; fast_pattern; distance:-17; within:17; sid:10120537; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-celticsfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-celticsfan.org"; fast_pattern; distance:-20; within:20; sid:10120538; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-celticsfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-celticsfan.org"; fast_pattern; distance:-20; within:20; sid:10120539; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-chef.com"; fast_pattern; distance:-14; within:14; sid:10120540; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-chef.com"; fast_pattern; distance:-14; within:14; sid:10120541; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-chef.net"; fast_pattern; distance:-14; within:14; sid:10120542; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-chef.net"; fast_pattern; distance:-14; within:14; sid:10120543; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-chef.org"; fast_pattern; distance:-14; within:14; sid:10120544; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-chef.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-chef.org"; fast_pattern; distance:-14; within:14; sid:10120545; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-conservative.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-conservative.com"; fast_pattern; distance:-22; within:22; sid:10120546; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-conservative.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-conservative.com"; fast_pattern; distance:-22; within:22; sid:10120547; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cpa.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-cpa.com"; fast_pattern; distance:-13; within:13; sid:10120548; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cpa.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-cpa.com"; fast_pattern; distance:-13; within:13; sid:10120549; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cubicle-slave.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-cubicle-slave.com"; fast_pattern; distance:-23; within:23; sid:10120550; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-cubicle-slave.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-cubicle-slave.com"; fast_pattern; distance:-23; within:23; sid:10120551; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-democrat.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-democrat.com"; fast_pattern; distance:-18; within:18; sid:10120552; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-democrat.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-democrat.com"; fast_pattern; distance:-18; within:18; sid:10120553; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-designer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-designer.com"; fast_pattern; distance:-18; within:18; sid:10120554; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-designer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-designer.com"; fast_pattern; distance:-18; within:18; sid:10120555; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-doctor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-doctor.com"; fast_pattern; distance:-16; within:16; sid:10120556; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-doctor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-doctor.com"; fast_pattern; distance:-16; within:16; sid:10120557; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-financialadvisor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-financialadvisor.com"; fast_pattern; distance:-26; within:26; sid:10120558; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-financialadvisor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-financialadvisor.com"; fast_pattern; distance:-26; within:26; sid:10120559; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-geek.com"; fast_pattern; distance:-14; within:14; sid:10120560; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-geek.com"; fast_pattern; distance:-14; within:14; sid:10120561; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-geek.net"; fast_pattern; distance:-14; within:14; sid:10120562; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-geek.net"; fast_pattern; distance:-14; within:14; sid:10120563; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-geek.org"; fast_pattern; distance:-14; within:14; sid:10120564; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-geek.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-geek.org"; fast_pattern; distance:-14; within:14; sid:10120565; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-green.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-green.com"; fast_pattern; distance:-15; within:15; sid:10120566; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-green.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-green.com"; fast_pattern; distance:-15; within:15; sid:10120567; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-guru.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-guru.com"; fast_pattern; distance:-14; within:14; sid:10120568; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-guru.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-guru.com"; fast_pattern; distance:-14; within:14; sid:10120569; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hard-worker.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-hard-worker.com"; fast_pattern; distance:-21; within:21; sid:10120570; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hard-worker.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-hard-worker.com"; fast_pattern; distance:-21; within:21; sid:10120571; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hunter.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-hunter.com"; fast_pattern; distance:-16; within:16; sid:10120572; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-hunter.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-hunter.com"; fast_pattern; distance:-16; within:16; sid:10120573; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-knight.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-knight.org"; fast_pattern; distance:-16; within:16; sid:10120574; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-knight.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-knight.org"; fast_pattern; distance:-16; within:16; sid:10120575; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-landscaper.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-landscaper.com"; fast_pattern; distance:-20; within:20; sid:10120576; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-landscaper.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-landscaper.com"; fast_pattern; distance:-20; within:20; sid:10120577; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-lawyer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-lawyer.com"; fast_pattern; distance:-16; within:16; sid:10120578; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-lawyer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-lawyer.com"; fast_pattern; distance:-16; within:16; sid:10120579; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-liberal.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-liberal.com"; fast_pattern; distance:-17; within:17; sid:10120580; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-liberal.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-liberal.com"; fast_pattern; distance:-17; within:17; sid:10120581; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-libertarian.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-libertarian.com"; fast_pattern; distance:-21; within:21; sid:10120582; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-libertarian.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-libertarian.com"; fast_pattern; distance:-21; within:21; sid:10120583; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-linux-user.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-linux-user.org"; fast_pattern; distance:-20; within:20; sid:10120584; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-linux-user.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-linux-user.org"; fast_pattern; distance:-20; within:20; sid:10120585; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-llama.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-llama.com"; fast_pattern; distance:-15; within:15; sid:10120586; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-llama.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-llama.com"; fast_pattern; distance:-15; within:15; sid:10120587; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-musician.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-musician.com"; fast_pattern; distance:-18; within:18; sid:10120588; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-musician.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-musician.com"; fast_pattern; distance:-18; within:18; sid:10120589; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nascarfan.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-nascarfan.com"; fast_pattern; distance:-19; within:19; sid:10120590; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nascarfan.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-nascarfan.com"; fast_pattern; distance:-19; within:19; sid:10120591; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nurse.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-nurse.com"; fast_pattern; distance:-15; within:15; sid:10120592; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-nurse.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-nurse.com"; fast_pattern; distance:-15; within:15; sid:10120593; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-painter.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-painter.com"; fast_pattern; distance:-17; within:17; sid:10120594; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-painter.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-painter.com"; fast_pattern; distance:-17; within:17; sid:10120595; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-patsfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-patsfan.org"; fast_pattern; distance:-17; within:17; sid:10120596; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-patsfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-patsfan.org"; fast_pattern; distance:-17; within:17; sid:10120597; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-personaltrainer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-personaltrainer.com"; fast_pattern; distance:-25; within:25; sid:10120598; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-personaltrainer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-personaltrainer.com"; fast_pattern; distance:-25; within:25; sid:10120599; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-photographer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-photographer.com"; fast_pattern; distance:-22; within:22; sid:10120600; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-photographer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-photographer.com"; fast_pattern; distance:-22; within:22; sid:10120601; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-player.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-player.com"; fast_pattern; distance:-16; within:16; sid:10120602; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-player.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-player.com"; fast_pattern; distance:-16; within:16; sid:10120603; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-republican.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-republican.com"; fast_pattern; distance:-20; within:20; sid:10120604; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-republican.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-republican.com"; fast_pattern; distance:-20; within:20; sid:10120605; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-rockstar.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-rockstar.com"; fast_pattern; distance:-18; within:18; sid:10120606; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-rockstar.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-rockstar.com"; fast_pattern; distance:-18; within:18; sid:10120607; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-socialist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-socialist.com"; fast_pattern; distance:-19; within:19; sid:10120608; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-socialist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-socialist.com"; fast_pattern; distance:-19; within:19; sid:10120609; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-soxfan.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-soxfan.org"; fast_pattern; distance:-16; within:16; sid:10120610; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-soxfan.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-soxfan.org"; fast_pattern; distance:-16; within:16; sid:10120611; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-student.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-student.com"; fast_pattern; distance:-17; within:17; sid:10120612; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-student.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-student.com"; fast_pattern; distance:-17; within:17; sid:10120613; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-teacher.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-teacher.com"; fast_pattern; distance:-17; within:17; sid:10120614; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-teacher.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-teacher.com"; fast_pattern; distance:-17; within:17; sid:10120615; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-techie.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-techie.com"; fast_pattern; distance:-16; within:16; sid:10120616; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-techie.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-techie.com"; fast_pattern; distance:-16; within:16; sid:10120617; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-therapist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-a-therapist.com"; fast_pattern; distance:-19; within:19; sid:10120618; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-a-therapist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-a-therapist.com"; fast_pattern; distance:-19; within:19; sid:10120619; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-accountant.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-accountant.com"; fast_pattern; distance:-21; within:21; sid:10120620; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-accountant.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-accountant.com"; fast_pattern; distance:-21; within:21; sid:10120621; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actor.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-actor.com"; fast_pattern; distance:-16; within:16; sid:10120622; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actor.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-actor.com"; fast_pattern; distance:-16; within:16; sid:10120623; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actress.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-actress.com"; fast_pattern; distance:-18; within:18; sid:10120624; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-actress.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-actress.com"; fast_pattern; distance:-18; within:18; sid:10120625; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-anarchist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-anarchist.com"; fast_pattern; distance:-20; within:20; sid:10120626; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-anarchist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-anarchist.com"; fast_pattern; distance:-20; within:20; sid:10120627; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-artist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-artist.com"; fast_pattern; distance:-17; within:17; sid:10120628; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-artist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-artist.com"; fast_pattern; distance:-17; within:17; sid:10120629; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-engineer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-engineer.com"; fast_pattern; distance:-19; within:19; sid:10120630; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-engineer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-engineer.com"; fast_pattern; distance:-19; within:19; sid:10120631; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-entertainer.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-an-entertainer.com"; fast_pattern; distance:-22; within:22; sid:10120632; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-an-entertainer.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-an-entertainer.com"; fast_pattern; distance:-22; within:22; sid:10120633; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-by.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-by.us"; fast_pattern; distance:-9; within:9; sid:10120634; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-by.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-by.us"; fast_pattern; distance:-9; within:9; sid:10120635; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-certified.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-certified.com"; fast_pattern; distance:-17; within:17; sid:10120636; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-certified.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-certified.com"; fast_pattern; distance:-17; within:17; sid:10120637; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-found.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-found.org"; fast_pattern; distance:-13; within:13; sid:10120638; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-found.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-found.org"; fast_pattern; distance:-13; within:13; sid:10120639; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-gone.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-gone.com"; fast_pattern; distance:-12; within:12; sid:10120640; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-gone.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-gone.com"; fast_pattern; distance:-12; within:12; sid:10120641; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-anime.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-anime.com"; fast_pattern; distance:-18; within:18; sid:10120642; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-anime.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-anime.com"; fast_pattern; distance:-18; within:18; sid:10120643; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cars.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-cars.com"; fast_pattern; distance:-17; within:17; sid:10120644; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cars.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-cars.com"; fast_pattern; distance:-17; within:17; sid:10120645; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cartoons.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-cartoons.com"; fast_pattern; distance:-21; within:21; sid:10120646; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-cartoons.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-cartoons.com"; fast_pattern; distance:-21; within:21; sid:10120647; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-games.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-into-games.com"; fast_pattern; distance:-18; within:18; sid:10120648; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-into-games.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-into-games.com"; fast_pattern; distance:-18; within:18; sid:10120649; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-leet.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-leet.com"; fast_pattern; distance:-12; within:12; sid:10120650; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-leet.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-leet.com"; fast_pattern; distance:-12; within:12; sid:10120651; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-lost.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-lost.org"; fast_pattern; distance:-12; within:12; sid:10120652; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-lost.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-lost.org"; fast_pattern; distance:-12; within:12; sid:10120653; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-not-certified.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-not-certified.com"; fast_pattern; distance:-21; within:21; sid:10120654; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-not-certified.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-not-certified.com"; fast_pattern; distance:-21; within:21; sid:10120655; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-saved.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-saved.org"; fast_pattern; distance:-13; within:13; sid:10120656; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-saved.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-saved.org"; fast_pattern; distance:-13; within:13; sid:10120657; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-slick.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-slick.com"; fast_pattern; distance:-13; within:13; sid:10120658; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-slick.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-slick.com"; fast_pattern; distance:-13; within:13; sid:10120659; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-uberleet.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-uberleet.com"; fast_pattern; distance:-16; within:16; sid:10120660; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-uberleet.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-uberleet.com"; fast_pattern; distance:-16; within:16; sid:10120661; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-bad.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-bad.org"; fast_pattern; distance:-16; within:16; sid:10120662; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-bad.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-bad.org"; fast_pattern; distance:-16; within:16; sid:10120663; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-evil.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-evil.org"; fast_pattern; distance:-17; within:17; sid:10120664; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-evil.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-evil.org"; fast_pattern; distance:-17; within:17; sid:10120665; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-good.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-good.org"; fast_pattern; distance:-17; within:17; sid:10120666; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-good.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-good.org"; fast_pattern; distance:-17; within:17; sid:10120667; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-nice.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-nice.org"; fast_pattern; distance:-17; within:17; sid:10120668; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-nice.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-nice.org"; fast_pattern; distance:-17; within:17; sid:10120669; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-sweet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-very-sweet.org"; fast_pattern; distance:-18; within:18; sid:10120670; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-very-sweet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-very-sweet.org"; fast_pattern; distance:-18; within:18; sid:10120671; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-with-theband.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".is-with-theband.com"; fast_pattern; distance:-20; within:20; sid:10120672; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain is-with-theband.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".is-with-theband.com"; fast_pattern; distance:-20; within:20; sid:10120673; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-geek.com"; fast_pattern; distance:-13; within:13; sid:10120674; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-geek.com"; fast_pattern; distance:-13; within:13; sid:10120675; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-geek.net"; fast_pattern; distance:-13; within:13; sid:10120676; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-geek.net"; fast_pattern; distance:-13; within:13; sid:10120677; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-geek.org"; fast_pattern; distance:-13; within:13; sid:10120678; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-geek.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-geek.org"; fast_pattern; distance:-13; within:13; sid:10120679; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-hockeynut.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isa-hockeynut.com"; fast_pattern; distance:-18; within:18; sid:10120680; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isa-hockeynut.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isa-hockeynut.com"; fast_pattern; distance:-18; within:18; sid:10120681; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain issmarterthanyou.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".issmarterthanyou.com"; fast_pattern; distance:-21; within:21; sid:10120682; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain issmarterthanyou.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".issmarterthanyou.com"; fast_pattern; distance:-21; within:21; sid:10120683; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isteingeek.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".isteingeek.de"; fast_pattern; distance:-14; within:14; sid:10120684; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain isteingeek.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".isteingeek.de"; fast_pattern; distance:-14; within:14; sid:10120685; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain istmein.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".istmein.de"; fast_pattern; distance:-11; within:11; sid:10120686; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain istmein.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".istmein.de"; fast_pattern; distance:-11; within:11; sid:10120687; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kicks-ass.net"; fast_pattern; distance:-14; within:14; sid:10120688; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kicks-ass.net"; fast_pattern; distance:-14; within:14; sid:10120689; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kicks-ass.org"; fast_pattern; distance:-14; within:14; sid:10120690; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain kicks-ass.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kicks-ass.org"; fast_pattern; distance:-14; within:14; sid:10120691; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain knowsitall.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".knowsitall.info"; fast_pattern; distance:-16; within:16; sid:10120692; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain knowsitall.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".knowsitall.info"; fast_pattern; distance:-16; within:16; sid:10120693; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain land-4-sale.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".land-4-sale.us"; fast_pattern; distance:-15; within:15; sid:10120694; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain land-4-sale.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".land-4-sale.us"; fast_pattern; distance:-15; within:15; sid:10120695; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain lebtimnetz.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".lebtimnetz.de"; fast_pattern; distance:-14; within:14; sid:10120696; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain lebtimnetz.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".lebtimnetz.de"; fast_pattern; distance:-14; within:14; sid:10120697; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain leitungsen.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".leitungsen.de"; fast_pattern; distance:-14; within:14; sid:10120698; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain leitungsen.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".leitungsen.de"; fast_pattern; distance:-14; within:14; sid:10120699; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likes-pie.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".likes-pie.com"; fast_pattern; distance:-14; within:14; sid:10120700; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likes-pie.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".likes-pie.com"; fast_pattern; distance:-14; within:14; sid:10120701; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likescandy.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".likescandy.com"; fast_pattern; distance:-15; within:15; sid:10120702; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain likescandy.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".likescandy.com"; fast_pattern; distance:-15; within:15; sid:10120703; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain merseine.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".merseine.nu"; fast_pattern; distance:-12; within:12; sid:10120704; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain merseine.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".merseine.nu"; fast_pattern; distance:-12; within:12; sid:10120705; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mine.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mine.nu"; fast_pattern; distance:-8; within:8; sid:10120706; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mine.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mine.nu"; fast_pattern; distance:-8; within:8; sid:10120707; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain misconfused.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".misconfused.org"; fast_pattern; distance:-16; within:16; sid:10120708; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain misconfused.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".misconfused.org"; fast_pattern; distance:-16; within:16; sid:10120709; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mypets.ws"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mypets.ws"; fast_pattern; distance:-10; within:10; sid:10120710; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain mypets.ws in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mypets.ws"; fast_pattern; distance:-10; within:10; sid:10120711; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain myphotos.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".myphotos.cc"; fast_pattern; distance:-12; within:12; sid:10120712; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain myphotos.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".myphotos.cc"; fast_pattern; distance:-12; within:12; sid:10120713; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain neat-url.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".neat-url.com"; fast_pattern; distance:-13; within:13; sid:10120714; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain neat-url.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".neat-url.com"; fast_pattern; distance:-13; within:13; sid:10120715; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain office-on-the.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".office-on-the.net"; fast_pattern; distance:-18; within:18; sid:10120716; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain office-on-the.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".office-on-the.net"; fast_pattern; distance:-18; within:18; sid:10120717; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain on-the-web.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".on-the-web.tv"; fast_pattern; distance:-14; within:14; sid:10120718; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain on-the-web.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".on-the-web.tv"; fast_pattern; distance:-14; within:14; sid:10120719; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".podzone.net"; fast_pattern; distance:-12; within:12; sid:10120720; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".podzone.net"; fast_pattern; distance:-12; within:12; sid:10120721; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".podzone.org"; fast_pattern; distance:-12; within:12; sid:10120722; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain podzone.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".podzone.org"; fast_pattern; distance:-12; within:12; sid:10120723; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain readmyblog.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".readmyblog.org"; fast_pattern; distance:-15; within:15; sid:10120724; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain readmyblog.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".readmyblog.org"; fast_pattern; distance:-15; within:15; sid:10120725; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain saves-the-whales.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".saves-the-whales.com"; fast_pattern; distance:-21; within:21; sid:10120726; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain saves-the-whales.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".saves-the-whales.com"; fast_pattern; distance:-21; within:21; sid:10120727; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapper-site.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scrapper-site.net"; fast_pattern; distance:-18; within:18; sid:10120728; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapper-site.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scrapper-site.net"; fast_pattern; distance:-18; within:18; sid:10120729; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapping.cc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".scrapping.cc"; fast_pattern; distance:-13; within:13; sid:10120730; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain scrapping.cc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".scrapping.cc"; fast_pattern; distance:-13; within:13; sid:10120731; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.biz"; fast_pattern; distance:-11; within:11; sid:10120732; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.biz"; fast_pattern; distance:-11; within:11; sid:10120733; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.com"; fast_pattern; distance:-11; within:11; sid:10120734; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.com"; fast_pattern; distance:-11; within:11; sid:10120735; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.info"; fast_pattern; distance:-12; within:12; sid:10120736; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.info"; fast_pattern; distance:-12; within:12; sid:10120737; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.net"; fast_pattern; distance:-11; within:11; sid:10120738; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.net"; fast_pattern; distance:-11; within:11; sid:10120739; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".selfip.org"; fast_pattern; distance:-11; within:11; sid:10120740; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain selfip.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".selfip.org"; fast_pattern; distance:-11; within:11; sid:10120741; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-less.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sells-for-less.com"; fast_pattern; distance:-19; within:19; sid:10120742; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-less.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sells-for-less.com"; fast_pattern; distance:-19; within:19; sid:10120743; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-u.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sells-for-u.com"; fast_pattern; distance:-16; within:16; sid:10120744; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-for-u.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sells-for-u.com"; fast_pattern; distance:-16; within:16; sid:10120745; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-it.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sells-it.net"; fast_pattern; distance:-13; within:13; sid:10120746; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sells-it.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sells-it.net"; fast_pattern; distance:-13; within:13; sid:10120747; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sellsyourhome.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".sellsyourhome.org"; fast_pattern; distance:-18; within:18; sid:10120748; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain sellsyourhome.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".sellsyourhome.org"; fast_pattern; distance:-18; within:18; sid:10120749; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebbs.com"; fast_pattern; distance:-13; within:13; sid:10120750; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebbs.com"; fast_pattern; distance:-13; within:13; sid:10120751; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebbs.net"; fast_pattern; distance:-13; within:13; sid:10120752; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebbs.net"; fast_pattern; distance:-13; within:13; sid:10120753; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servebbs.org"; fast_pattern; distance:-13; within:13; sid:10120754; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servebbs.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servebbs.org"; fast_pattern; distance:-13; within:13; sid:10120755; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveftp.net"; fast_pattern; distance:-13; within:13; sid:10120756; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveftp.net"; fast_pattern; distance:-13; within:13; sid:10120757; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serveftp.org"; fast_pattern; distance:-13; within:13; sid:10120758; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain serveftp.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serveftp.org"; fast_pattern; distance:-13; within:13; sid:10120759; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servegame.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".servegame.org"; fast_pattern; distance:-14; within:14; sid:10120760; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain servegame.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".servegame.org"; fast_pattern; distance:-14; within:14; sid:10120761; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain shacknet.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shacknet.nu"; fast_pattern; distance:-12; within:12; sid:10120762; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain shacknet.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shacknet.nu"; fast_pattern; distance:-12; within:12; sid:10120763; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain simple-url.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".simple-url.com"; fast_pattern; distance:-15; within:15; sid:10120764; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain simple-url.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".simple-url.com"; fast_pattern; distance:-15; within:15; sid:10120765; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain space-to-rent.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".space-to-rent.com"; fast_pattern; distance:-18; within:18; sid:10120766; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain space-to-rent.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".space-to-rent.com"; fast_pattern; distance:-18; within:18; sid:10120767; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stuff-4-sale.org"; fast_pattern; distance:-17; within:17; sid:10120768; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stuff-4-sale.org"; fast_pattern; distance:-17; within:17; sid:10120769; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stuff-4-sale.us"; fast_pattern; distance:-16; within:16; sid:10120770; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain stuff-4-sale.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stuff-4-sale.us"; fast_pattern; distance:-16; within:16; sid:10120771; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain teaches-yoga.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".teaches-yoga.com"; fast_pattern; distance:-17; within:17; sid:10120772; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain teaches-yoga.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".teaches-yoga.com"; fast_pattern; distance:-17; within:17; sid:10120773; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain thruhere.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".thruhere.net"; fast_pattern; distance:-13; within:13; sid:10120774; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain thruhere.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".thruhere.net"; fast_pattern; distance:-13; within:13; sid:10120775; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain traeumtgerade.de"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".traeumtgerade.de"; fast_pattern; distance:-17; within:17; sid:10120776; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain traeumtgerade.de in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".traeumtgerade.de"; fast_pattern; distance:-17; within:17; sid:10120777; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.biz"; fast_pattern; distance:-11; within:11; sid:10120778; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.biz"; fast_pattern; distance:-11; within:11; sid:10120779; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.info"; fast_pattern; distance:-12; within:12; sid:10120780; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.info"; fast_pattern; distance:-12; within:12; sid:10120781; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.net"; fast_pattern; distance:-11; within:11; sid:10120782; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.net"; fast_pattern; distance:-11; within:11; sid:10120783; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".webhop.org"; fast_pattern; distance:-11; within:11; sid:10120784; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain webhop.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".webhop.org"; fast_pattern; distance:-11; within:11; sid:10120785; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain worse-than.tv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".worse-than.tv"; fast_pattern; distance:-14; within:14; sid:10120786; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain worse-than.tv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".worse-than.tv"; fast_pattern; distance:-14; within:14; sid:10120787; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain writesthisblog.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".writesthisblog.com"; fast_pattern; distance:-19; within:19; sid:10120788; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DYN.com domain writesthisblog.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".writesthisblog.com"; fast_pattern; distance:-19; within:19; sid:10120789; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain publicvm.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".publicvm.com"; fast_pattern; distance:-13; within:13; sid:10120790; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain publicvm.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".publicvm.com"; fast_pattern; distance:-13; within:13; sid:10120791; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain linkpc.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".linkpc.net"; fast_pattern; distance:-11; within:11; sid:10120792; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for DNSEXIT.com domain linkpc.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".linkpc.net"; fast_pattern; distance:-11; within:11; sid:10120793; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mooo.com"; fast_pattern; distance:-9; within:9; sid:10120794; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mooo.com"; fast_pattern; distance:-9; within:9; sid:10120795; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain chickenkiller.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".chickenkiller.com"; fast_pattern; distance:-18; within:18; sid:10120796; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain chickenkiller.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".chickenkiller.com"; fast_pattern; distance:-18; within:18; sid:10120797; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain us.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".us.to"; fast_pattern; distance:-6; within:6; sid:10120798; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain us.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".us.to"; fast_pattern; distance:-6; within:6; sid:10120799; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain strangled.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".strangled.net"; fast_pattern; distance:-14; within:14; sid:10120800; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain strangled.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".strangled.net"; fast_pattern; distance:-14; within:14; sid:10120801; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ignorelist.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ignorelist.com"; fast_pattern; distance:-15; within:15; sid:10120802; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ignorelist.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ignorelist.com"; fast_pattern; distance:-15; within:15; sid:10120803; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uk.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".uk.to"; fast_pattern; distance:-6; within:6; sid:10120804; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain uk.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".uk.to"; fast_pattern; distance:-6; within:6; sid:10120805; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crabdance.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".crabdance.com"; fast_pattern; distance:-14; within:14; sid:10120806; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crabdance.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".crabdance.com"; fast_pattern; distance:-14; within:14; sid:10120807; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.tm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".info.tm"; fast_pattern; distance:-8; within:8; sid:10120808; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.tm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".info.tm"; fast_pattern; distance:-8; within:8; sid:10120809; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain homenet.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".homenet.org"; fast_pattern; distance:-12; within:12; sid:10120810; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain homenet.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".homenet.org"; fast_pattern; distance:-12; within:12; sid:10120811; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jumpingcrab.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".jumpingcrab.com"; fast_pattern; distance:-16; within:16; sid:10120812; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain jumpingcrab.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".jumpingcrab.com"; fast_pattern; distance:-16; within:16; sid:10120813; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain twilightparadox.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".twilightparadox.com"; fast_pattern; distance:-20; within:20; sid:10120814; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain twilightparadox.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".twilightparadox.com"; fast_pattern; distance:-20; within:20; sid:10120815; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain biz.tm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".biz.tm"; fast_pattern; distance:-7; within:7; sid:10120816; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain biz.tm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".biz.tm"; fast_pattern; distance:-7; within:7; sid:10120817; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain continent.kz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".continent.kz"; fast_pattern; distance:-13; within:13; sid:10120818; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain continent.kz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".continent.kz"; fast_pattern; distance:-13; within:13; sid:10120819; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yao.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".yao.cl"; fast_pattern; distance:-7; within:7; sid:10120820; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain yao.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".yao.cl"; fast_pattern; distance:-7; within:7; sid:10120821; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ax.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ax.lt"; fast_pattern; distance:-6; within:6; sid:10120822; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ax.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ax.lt"; fast_pattern; distance:-6; within:6; sid:10120823; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privatedns.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".privatedns.org"; fast_pattern; distance:-15; within:15; sid:10120824; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain privatedns.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".privatedns.org"; fast_pattern; distance:-15; within:15; sid:10120825; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hacked.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hacked.jp"; fast_pattern; distance:-10; within:10; sid:10120826; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hacked.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hacked.jp"; fast_pattern; distance:-10; within:10; sid:10120827; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ftp.sh"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ftp.sh"; fast_pattern; distance:-7; within:7; sid:10120828; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ftp.sh in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ftp.sh"; fast_pattern; distance:-7; within:7; sid:10120829; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain now.im"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".now.im"; fast_pattern; distance:-7; within:7; sid:10120830; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain now.im in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".now.im"; fast_pattern; distance:-7; within:7; sid:10120831; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bep.co.id"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bep.co.id"; fast_pattern; distance:-10; within:10; sid:10120832; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bep.co.id in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bep.co.id"; fast_pattern; distance:-10; within:10; sid:10120833; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain undo.it"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".undo.it"; fast_pattern; distance:-8; within:8; sid:10120834; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain undo.it in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".undo.it"; fast_pattern; distance:-8; within:8; sid:10120835; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bot.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bot.nu"; fast_pattern; distance:-7; within:7; sid:10120836; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bot.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bot.nu"; fast_pattern; distance:-7; within:7; sid:10120837; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kalbas.com.vn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kalbas.com.vn"; fast_pattern; distance:-14; within:14; sid:10120838; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kalbas.com.vn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kalbas.com.vn"; fast_pattern; distance:-14; within:14; sid:10120839; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qc.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".qc.to"; fast_pattern; distance:-6; within:6; sid:10120840; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain qc.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".qc.to"; fast_pattern; distance:-6; within:6; sid:10120841; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 3dxtras.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".3dxtras.com"; fast_pattern; distance:-12; within:12; sid:10120842; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 3dxtras.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".3dxtras.com"; fast_pattern; distance:-12; within:12; sid:10120843; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pwnz.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".pwnz.org"; fast_pattern; distance:-9; within:9; sid:10120844; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain pwnz.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".pwnz.org"; fast_pattern; distance:-9; within:9; sid:10120845; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mine.bz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mine.bz"; fast_pattern; distance:-8; within:8; sid:10120846; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mine.bz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mine.bz"; fast_pattern; distance:-8; within:8; sid:10120847; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dynet.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".dynet.com"; fast_pattern; distance:-10; within:10; sid:10120848; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain dynet.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".dynet.com"; fast_pattern; distance:-10; within:10; sid:10120849; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.gf"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".info.gf"; fast_pattern; distance:-8; within:8; sid:10120850; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain info.gf in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".info.gf"; fast_pattern; distance:-8; within:8; sid:10120851; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain my.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".my.to"; fast_pattern; distance:-6; within:6; sid:10120852; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain my.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".my.to"; fast_pattern; distance:-6; within:6; sid:10120853; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain allowed.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".allowed.org"; fast_pattern; distance:-12; within:12; sid:10120854; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain allowed.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".allowed.org"; fast_pattern; distance:-12; within:12; sid:10120855; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain god.jp"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".god.jp"; fast_pattern; distance:-7; within:7; sid:10120856; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain god.jp in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".god.jp"; fast_pattern; distance:-7; within:7; sid:10120857; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain home.kg"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".home.kg"; fast_pattern; distance:-8; within:8; sid:10120858; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain home.kg in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".home.kg"; fast_pattern; distance:-8; within:8; sid:10120859; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shop.tm"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".shop.tm"; fast_pattern; distance:-8; within:8; sid:10120860; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain shop.tm in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".shop.tm"; fast_pattern; distance:-8; within:8; sid:10120861; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ro.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ro.lt"; fast_pattern; distance:-6; within:6; sid:10120862; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ro.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ro.lt"; fast_pattern; distance:-6; within:6; sid:10120863; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain t28.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".t28.net"; fast_pattern; distance:-8; within:8; sid:10120864; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain t28.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".t28.net"; fast_pattern; distance:-8; within:8; sid:10120865; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftnoob.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".minecraftnoob.com"; fast_pattern; distance:-18; within:18; sid:10120866; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftnoob.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".minecraftnoob.com"; fast_pattern; distance:-18; within:18; sid:10120867; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 69.mu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".69.mu"; fast_pattern; distance:-6; within:6; sid:10120868; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 69.mu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".69.mu"; fast_pattern; distance:-6; within:6; sid:10120869; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain spacetechnology.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".spacetechnology.net"; fast_pattern; distance:-20; within:20; sid:10120870; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain spacetechnology.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".spacetechnology.net"; fast_pattern; distance:-20; within:20; sid:10120871; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gw.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".gw.lt"; fast_pattern; distance:-6; within:6; sid:10120872; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain gw.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".gw.lt"; fast_pattern; distance:-6; within:6; sid:10120873; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain root.sx"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".root.sx"; fast_pattern; distance:-8; within:8; sid:10120874; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain root.sx in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".root.sx"; fast_pattern; distance:-8; within:8; sid:10120875; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nx.tc"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nx.tc"; fast_pattern; distance:-6; within:6; sid:10120876; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nx.tc in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nx.tc"; fast_pattern; distance:-6; within:6; sid:10120877; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain k.vu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".k.vu"; fast_pattern; distance:-5; within:5; sid:10120878; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain k.vu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".k.vu"; fast_pattern; distance:-5; within:5; sid:10120879; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mooo.info"; fast_pattern; distance:-10; within:10; sid:10120880; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mooo.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mooo.info"; fast_pattern; distance:-10; within:10; sid:10120881; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain farted.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".farted.net"; fast_pattern; distance:-11; within:11; sid:10120882; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain farted.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".farted.net"; fast_pattern; distance:-11; within:11; sid:10120883; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftr.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".minecraftr.us"; fast_pattern; distance:-14; within:14; sid:10120884; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain minecraftr.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".minecraftr.us"; fast_pattern; distance:-14; within:14; sid:10120885; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain port0.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".port0.org"; fast_pattern; distance:-10; within:10; sid:10120886; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain port0.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".port0.org"; fast_pattern; distance:-10; within:10; sid:10120887; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyforever.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".happyforever.com"; fast_pattern; distance:-17; within:17; sid:10120888; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain happyforever.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".happyforever.com"; fast_pattern; distance:-17; within:17; sid:10120889; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cr.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".cr.rs"; fast_pattern; distance:-6; within:6; sid:10120890; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain cr.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".cr.rs"; fast_pattern; distance:-6; within:6; sid:10120891; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bigbox.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bigbox.info"; fast_pattern; distance:-12; within:12; sid:10120892; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bigbox.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bigbox.info"; fast_pattern; distance:-12; within:12; sid:10120893; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 1337.cx"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".1337.cx"; fast_pattern; distance:-8; within:8; sid:10120894; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 1337.cx in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".1337.cx"; fast_pattern; distance:-8; within:8; sid:10120895; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evils.in"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".evils.in"; fast_pattern; distance:-9; within:9; sid:10120896; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain evils.in in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".evils.in"; fast_pattern; distance:-9; within:9; sid:10120897; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain csproject.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".csproject.org"; fast_pattern; distance:-14; within:14; sid:10120898; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain csproject.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".csproject.org"; fast_pattern; distance:-14; within:14; sid:10120899; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain verymad.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".verymad.net"; fast_pattern; distance:-12; within:12; sid:10120900; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain verymad.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".verymad.net"; fast_pattern; distance:-12; within:12; sid:10120901; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fr.to"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fr.to"; fast_pattern; distance:-6; within:6; sid:10120902; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fr.to in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fr.to"; fast_pattern; distance:-6; within:6; sid:10120903; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain serverpit.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".serverpit.com"; fast_pattern; distance:-14; within:14; sid:10120904; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain serverpit.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".serverpit.com"; fast_pattern; distance:-14; within:14; sid:10120905; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vr.lt"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vr.lt"; fast_pattern; distance:-6; within:6; sid:10120906; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vr.lt in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vr.lt"; fast_pattern; distance:-6; within:6; sid:10120907; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain punked.us"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".punked.us"; fast_pattern; distance:-10; within:10; sid:10120908; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain punked.us in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".punked.us"; fast_pattern; distance:-10; within:10; sid:10120909; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain suka.se"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".suka.se"; fast_pattern; distance:-8; within:8; sid:10120910; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain suka.se in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".suka.se"; fast_pattern; distance:-8; within:8; sid:10120911; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h4ck.me"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".h4ck.me"; fast_pattern; distance:-8; within:8; sid:10120912; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h4ck.me in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".h4ck.me"; fast_pattern; distance:-8; within:8; sid:10120913; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain soon.it"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".soon.it"; fast_pattern; distance:-8; within:8; sid:10120914; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain soon.it in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".soon.it"; fast_pattern; distance:-8; within:8; sid:10120915; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thcgirls.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".thcgirls.com"; fast_pattern; distance:-13; within:13; sid:10120916; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain thcgirls.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".thcgirls.com"; fast_pattern; distance:-13; within:13; sid:10120917; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iz.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iz.rs"; fast_pattern; distance:-6; within:6; sid:10120918; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iz.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iz.rs"; fast_pattern; distance:-6; within:6; sid:10120919; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain madhacker.biz"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".madhacker.biz"; fast_pattern; distance:-14; within:14; sid:10120920; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain madhacker.biz in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".madhacker.biz"; fast_pattern; distance:-14; within:14; sid:10120921; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fedea.com.ar"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fedea.com.ar"; fast_pattern; distance:-13; within:13; sid:10120922; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fedea.com.ar in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fedea.com.ar"; fast_pattern; distance:-13; within:13; sid:10120923; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain icfar.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".icfar.com"; fast_pattern; distance:-10; within:10; sid:10120924; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain icfar.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".icfar.com"; fast_pattern; distance:-10; within:10; sid:10120925; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain r-o-o-t.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".r-o-o-t.net"; fast_pattern; distance:-12; within:12; sid:10120926; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain r-o-o-t.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".r-o-o-t.net"; fast_pattern; distance:-12; within:12; sid:10120927; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 404.mn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".404.mn"; fast_pattern; distance:-7; within:7; sid:10120928; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 404.mn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".404.mn"; fast_pattern; distance:-7; within:7; sid:10120929; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kir22.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".kir22.ru"; fast_pattern; distance:-9; within:9; sid:10120930; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain kir22.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".kir22.ru"; fast_pattern; distance:-9; within:9; sid:10120931; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain byte4byte.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".byte4byte.com"; fast_pattern; distance:-14; within:14; sid:10120932; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain byte4byte.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".byte4byte.com"; fast_pattern; distance:-14; within:14; sid:10120933; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 120v.ac"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".120v.ac"; fast_pattern; distance:-8; within:8; sid:10120934; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 120v.ac in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".120v.ac"; fast_pattern; distance:-8; within:8; sid:10120935; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain d-n-s.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".d-n-s.name"; fast_pattern; distance:-11; within:11; sid:10120936; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain d-n-s.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".d-n-s.name"; fast_pattern; distance:-11; within:11; sid:10120937; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h-o-s-t.name"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".h-o-s-t.name"; fast_pattern; distance:-13; within:13; sid:10120938; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain h-o-s-t.name in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".h-o-s-t.name"; fast_pattern; distance:-13; within:13; sid:10120939; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psybnc.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".psybnc.org"; fast_pattern; distance:-11; within:11; sid:10120940; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psybnc.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".psybnc.org"; fast_pattern; distance:-11; within:11; sid:10120941; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zanity.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".zanity.net"; fast_pattern; distance:-11; within:11; sid:10120942; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain zanity.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".zanity.net"; fast_pattern; distance:-11; within:11; sid:10120943; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hashcube.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hashcube.com"; fast_pattern; distance:-13; within:13; sid:10120944; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hashcube.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hashcube.com"; fast_pattern; distance:-13; within:13; sid:10120945; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ohbah.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".ohbah.com"; fast_pattern; distance:-10; within:10; sid:10120946; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain ohbah.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".ohbah.com"; fast_pattern; distance:-10; within:10; sid:10120947; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 24-7.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".24-7.ro"; fast_pattern; distance:-8; within:8; sid:10120948; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain 24-7.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".24-7.ro"; fast_pattern; distance:-8; within:8; sid:10120949; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mm.my"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".mm.my"; fast_pattern; distance:-6; within:6; sid:10120950; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain mm.my in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".mm.my"; fast_pattern; distance:-6; within:6; sid:10120951; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iiiii.info"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iiiii.info"; fast_pattern; distance:-11; within:11; sid:10120952; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iiiii.info in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iiiii.info"; fast_pattern; distance:-11; within:11; sid:10120953; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain abuser.eu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".abuser.eu"; fast_pattern; distance:-10; within:10; sid:10120954; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain abuser.eu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".abuser.eu"; fast_pattern; distance:-10; within:10; sid:10120955; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain star.is"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".star.is"; fast_pattern; distance:-8; within:8; sid:10120956; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain star.is in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".star.is"; fast_pattern; distance:-8; within:8; sid:10120957; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain epicgamer.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".epicgamer.org"; fast_pattern; distance:-14; within:14; sid:10120958; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain epicgamer.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".epicgamer.org"; fast_pattern; distance:-14; within:14; sid:10120959; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vietnam.ro"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".vietnam.ro"; fast_pattern; distance:-11; within:11; sid:10120960; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain vietnam.ro in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".vietnam.ro"; fast_pattern; distance:-11; within:11; sid:10120961; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hackquest.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hackquest.com"; fast_pattern; distance:-14; within:14; sid:10120962; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hackquest.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hackquest.com"; fast_pattern; distance:-14; within:14; sid:10120963; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain photo-frame.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".photo-frame.com"; fast_pattern; distance:-16; within:16; sid:10120964; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain photo-frame.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".photo-frame.com"; fast_pattern; distance:-16; within:16; sid:10120965; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iminecraft.se"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".iminecraft.se"; fast_pattern; distance:-14; within:14; sid:10120966; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain iminecraft.se in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".iminecraft.se"; fast_pattern; distance:-14; within:14; sid:10120967; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oo.fi"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".oo.fi"; fast_pattern; distance:-6; within:6; sid:10120968; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain oo.fi in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".oo.fi"; fast_pattern; distance:-6; within:6; sid:10120969; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain javafaq.nu"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".javafaq.nu"; fast_pattern; distance:-11; within:11; sid:10120970; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain javafaq.nu in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".javafaq.nu"; fast_pattern; distance:-11; within:11; sid:10120971; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bestforever.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bestforever.com"; fast_pattern; distance:-16; within:16; sid:10120972; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bestforever.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bestforever.com"; fast_pattern; distance:-16; within:16; sid:10120973; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain antongorbunov.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".antongorbunov.com"; fast_pattern; distance:-18; within:18; sid:10120974; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain antongorbunov.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".antongorbunov.com"; fast_pattern; distance:-18; within:18; sid:10120975; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agropeople.ru"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".agropeople.ru"; fast_pattern; distance:-14; within:14; sid:10120976; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain agropeople.ru in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".agropeople.ru"; fast_pattern; distance:-14; within:14; sid:10120977; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psp-moscow.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".psp-moscow.com"; fast_pattern; distance:-15; within:15; sid:10120978; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain psp-moscow.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".psp-moscow.com"; fast_pattern; distance:-15; within:15; sid:10120979; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crackedsidewalks.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".crackedsidewalks.com"; fast_pattern; distance:-21; within:21; sid:10120980; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain crackedsidewalks.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".crackedsidewalks.com"; fast_pattern; distance:-21; within:21; sid:10120981; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain eye.rs"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".eye.rs"; fast_pattern; distance:-7; within:7; sid:10120982; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain eye.rs in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".eye.rs"; fast_pattern; distance:-7; within:7; sid:10120983; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain silksky.com"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".silksky.com"; fast_pattern; distance:-12; within:12; sid:10120984; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain silksky.com in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".silksky.com"; fast_pattern; distance:-12; within:12; sid:10120985; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain drunkensailor.org"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".drunkensailor.org"; fast_pattern; distance:-18; within:18; sid:10120986; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain drunkensailor.org in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".drunkensailor.org"; fast_pattern; distance:-18; within:18; sid:10120987; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stfu-kthx.net"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".stfu-kthx.net"; fast_pattern; distance:-14; within:14; sid:10120988; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain stfu-kthx.net in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".stfu-kthx.net"; fast_pattern; distance:-14; within:14; sid:10120989; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fol.cl"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".fol.cl"; fast_pattern; distance:-7; within:7; sid:10120990; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain fol.cl in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".fol.cl"; fast_pattern; distance:-7; within:7; sid:10120991; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain baltijalv.lv"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".baltijalv.lv"; fast_pattern; distance:-13; within:13; sid:10120992; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain baltijalv.lv in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".baltijalv.lv"; fast_pattern; distance:-13; within:13; sid:10120993; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bad.mn"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".bad.mn"; fast_pattern; distance:-7; within:7; sid:10120994; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain bad.mn in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".bad.mn"; fast_pattern; distance:-7; within:7; sid:10120995; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hpc.tw"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".hpc.tw"; fast_pattern; distance:-7; within:7; sid:10120996; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain hpc.tw in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".hpc.tw"; fast_pattern; distance:-7; within:7; sid:10120997; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nard.ca"; flow:established,from_server; content:"|55 04 03|"; byte_jump:1,1,relative; content:".nard.ca"; fast_pattern; distance:-8; within:8; sid:10120998; rev:1; classtype:misc-activity;)
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO SUSPICIOUS SSL Cert for Afraid DNS domain nard.ca in (SAN)"; flow:established,from_server; content:"|55 1d 11|"; content:"|82|"; distance:0; byte_jump:1,0,relative; content:".nard.ca"; fast_pattern; distance:-8; within:8; sid:10120999; rev:1; classtype:misc-activity;)