alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020coronaviruspandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020coronaviruspandemic.com"; sid:512000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 5gcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"5gcoronavirus.com"; sid:512001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for against-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"against-coronavirus.com"; sid:512002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona19.com"; sid:512003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticorona.club"; sid:512004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovid19virus.com"; sid:512005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiviruscovid19.com"; sid:512006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for atcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"atcoronavirus.com"; sid:512007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for awesome-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"awesome-coronavirus.com"; sid:512008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid-19.com"; sid:512009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid.com"; sid:512010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronaready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronaready.com"; sid:512011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronamap.com"; sid:512012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecorona.com"; sid:512013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byecovid.com"; sid:512014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for concoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"concoronavirus.com"; sid:512015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19korea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19korea.com"; sid:512016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-19.net"; sid:512017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19shot.com"; sid:512018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaa.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaa.club"; sid:512019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alert.com"; sid:512020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alerte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alerte.com"; sid:512021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarmor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarmor.com"; sid:512022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababes.com"; sid:512023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies.com"; sid:512024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababies.net"; sid:512025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababy.com"; sid:512026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabee.com"; sid:512027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabit.com"; sid:512028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreak.com"; sid:512029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabump.com"; sid:512030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabump.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabump.net"; sid:512031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabunker.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabunker.biz"; sid:512032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.co.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.co.uk"; sid:512033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare.uk - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare.uk"; sid:512034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachain.com"; sid:512035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachella.com"; sid:512036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclaim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclaim.com"; sid:512037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclear.com"; sid:512038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloak.com"; sid:512039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontainment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontainment.com"; sid:512040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacop.com"; sid:512041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorona.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorona.today"; sid:512042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrate.com"; sid:512043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisis.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisis.net"; sid:512044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacut.com"; sid:512045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadancefestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadancefestival.com"; sid:512046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-desinfektion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-desinfektion.net"; sid:512047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesinfektion.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesinfektion.net"; sid:512048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadestroyer.com"; sid:512049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiseasemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiseasemask.com"; sid:512050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadoheightsseniorliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadoheightsseniorliving.com"; sid:512051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadude.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadude.com"; sid:512052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafestival.com"; sid:512053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafever.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafever.com"; sid:512054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighters.com"; sid:512055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguards.com"; sid:512056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahoax.com"; sid:512057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainamerica.com"; sid:512058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfectioncare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfectioncare.com"; sid:512059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainfection.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainfection.report"; sid:512060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-japan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-japan.net"; sid:512061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakey.com"; sid:512062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.com"; sid:512063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killer.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killer.net"; sid:512064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiller.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiller.net"; sid:512065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalawsuits.com"; sid:512066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamap.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamap.life"; sid:512067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasck.com"; sid:512068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskus.com"; sid:512069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameme.com"; sid:512070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamen.com"; sid:512071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamvirus.com"; sid:512072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanegative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanegative.com"; sid:512073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanerd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanerd.com"; sid:512074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaofficialgovernmentwebsites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaofficialgovernmentwebsites.com"; sid:512075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaon.com"; sid:512076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoutbreakworldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoutbreakworldmap.com"; sid:512077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapaniek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapaniek.com"; sid:512078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepp.com"; sid:512079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotec.fr - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotec.fr"; sid:512080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectiveequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectiveequipment.com"; sid:512081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-quarantine.com"; sid:512082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ready.com"; sid:512083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafemasks.com"; sid:512084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysolutions.com"; sid:512085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetysolutions.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetysolutions.net"; sid:512086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasave.com"; sid:512087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzmaske.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzmaske.com"; sid:512088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascript.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascript.com"; sid:512089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascriptjs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascriptjs.com"; sid:512090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascuba.com"; sid:512091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfassessment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfassessment.com"; sid:512092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashirt.com"; sid:512093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronas-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronas-prevention.com"; sid:512094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprevention.com"; sid:512095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvivalplayingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvivalplayingcards.com"; sid:512096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatester.com"; sid:512097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestingkits.com"; sid:512098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tracker.com"; sid:512099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdateapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdateapp.com"; sid:512100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaccineus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaccineus.com"; sid:512101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavandaag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavandaag.com"; sid:512102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviral.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviral.fyi"; sid:512103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisadvice.com"; sid:512104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19spray.com"; sid:512105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19spray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19spray.com"; sid:512106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-20.com"; sid:512107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairmask.com"; sid:512108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisoftware.com"; sid:512109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaisoftware.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaisoftware.net"; sid:512110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-area.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-area.com"; sid:512111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusau.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusau.com"; sid:512112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-awareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-awareness.com"; sid:512113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawarenesss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawarenesss.com"; sid:512114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusban.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusban.com"; sid:512115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakingnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakingnewsnow.com"; sid:512116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscannabiscbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscannabiscbdoil.com"; sid:512117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscannabisoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscannabisoil.com"; sid:512118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapecod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapecod.com"; sid:512119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscards.com"; sid:512120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareclinic.com"; sid:512121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarestore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarestore.com"; sid:512122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaribbean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaribbean.com"; sid:512123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbdoil.com"; sid:512124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbgaoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbgaoil.com"; sid:512125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscbgoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscbgoil.com"; sid:512126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-check.com"; sid:512127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-check.com"; sid:512128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.cleaning - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.cleaning"; sid:512129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclean-up.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclean-up.com"; sid:512130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscompensation.com"; sid:512131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscongress.com"; sid:512132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisismanagementplan.com"; sid:512133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrisisplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrisisplan.com"; sid:512134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusd-19antidote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusd-19antidote.com"; sid:512135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusde.com"; sid:512136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefencepack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefencepack.com"; sid:512137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenders.com"; sid:512138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiaries.com"; sid:512139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomainer.com"; sid:512140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyplans.com"; sid:512141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencyresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencyresponseplan.com"; sid:512142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusespandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusespandemic.com"; sid:512143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestrends.com"; sid:512144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexchange.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexchange.com"; sid:512145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-export.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-export.com"; sid:512146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexport.com"; sid:512147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemasks.net"; sid:512148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusfacialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusfacialmask.com"; sid:512149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacialmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacialmask.com"; sid:512150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacialmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacialmasks.com"; sid:512151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfactcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfactcheck.com"; sid:512152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaq.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaq.net"; sid:512153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfear.com"; sid:512154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfun.com"; sid:512155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfunds.com"; sid:512156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgift.com"; sid:512157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.graphics"; sid:512158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanitiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanitiser.com"; sid:512159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandwashing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandwashing.com"; sid:512160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-health.com"; sid:512161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthkit.com"; sid:512162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthkits.com"; sid:512163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthpack.com"; sid:512164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthpacks.com"; sid:512165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthstore.com"; sid:512166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpus.com"; sid:512167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomekit.com"; sid:512168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomeprotection.com"; sid:512169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpact.com"; sid:512170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfection.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfection.report"; sid:512171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinnews.com"; sid:512172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinternet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinternet.com"; sid:512173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.kitchen - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.kitchen"; sid:512174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleakedinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleakedinfo.com"; sid:512175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-locations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-locations.com"; sid:512176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-losangeles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-losangeles.com"; sid:512177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaplive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaplive.com"; sid:512178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketplace.com"; sid:512179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmart.com"; sid:512180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasck.com"; sid:512181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskco.com"; sid:512182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskhelp.com"; sid:512183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mask-n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mask-n95.com"; sid:512184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskpro.com"; sid:512185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmath.com"; sid:512186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalstore.com"; sid:512187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedstore.com"; sid:512188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiracle.com"; sid:512189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusictherapist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusictherapist.com"; sid:512190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalcures.com"; sid:512191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalcures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalcures.net"; sid:512192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalremedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalremedies.com"; sid:512193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalremedies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalremedies.net"; sid:512194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewengland.com"; sid:512195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nhs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nhs.com"; sid:512196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnoticias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnoticias.com"; sid:512197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-novosti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-novosti.com"; sid:512198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-nyc.com"; sid:512199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspac.com"; sid:512200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspacs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspacs.com"; sid:512201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicmap.com"; sid:512202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspizza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspizza.com"; sid:512203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanforschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanforschools.com"; sid:512204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-poll.com"; sid:512205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-poll.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-poll.com"; sid:512206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prep.com"; sid:512207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusprep.com"; sid:512208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prep.com"; sid:512209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprophecy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprophecy.com"; sid:512210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectionnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectionnow.com"; sid:512211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrelief.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrelief.net"; sid:512212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-rus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-rus.com"; sid:512213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscams.com"; sid:512214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussf.com"; sid:512215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussia.com"; sid:512216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-simptomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-simptomy.com"; sid:512217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussimulator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussimulator.com"; sid:512218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussmasks.com"; sid:512219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-statistic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-statistic.com"; sid:512220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussteps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussteps.com"; sid:512221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrategies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrategies.com"; sid:512222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvey.net"; sid:512223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustech.com"; sid:512224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test.net"; sid:512225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrends.com"; sid:512226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-uk.com"; sid:512227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunitedstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunitedstates.com"; sid:512228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusupdates.com"; sid:512229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateslive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateslive.com"; sid:512230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdateslive.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdateslive.net"; sid:512231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdates.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdates.world"; sid:512232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatetoday.com"; sid:512233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacuna.com"; sid:512234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswa.com"; sid:512235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashington.com"; sid:512236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebsite.com"; sid:512237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswellness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswellness.com"; sid:512238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweltweit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweltweit.com"; sid:512239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world.com"; sid:512240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszine.com"; sid:512241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.zone"; sid:512242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavpn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavpn.com"; sid:512243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawell.com"; sid:512244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldwide.com"; sid:512245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19care.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19care.net"; sid:512246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbd.com"; sid:512247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cbdoil.com"; sid:512248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19centers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19centers.com"; sid:512249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinic.com"; sid:512250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19closures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19closures.com"; sid:512251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compensation.com"; sid:512252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crisismanagementplan.com"; sid:512253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19decontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19decontamination.com"; sid:512254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19domains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19domains.com"; sid:512255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergencyresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergencyresponseplan.com"; sid:512256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19essentials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19essentials.com"; sid:512257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19everything.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19everything.com"; sid:512258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19faceguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19faceguard.com"; sid:512259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-free.com"; sid:512260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19free.com"; sid:512261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19global.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19global.net"; sid:512262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthcare.com"; sid:512263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19healthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19healthkit.com"; sid:512264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthstore.com"; sid:512265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hoax.com"; sid:512266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homekit.com"; sid:512267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19info.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19info.life"; sid:512268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19initiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19initiative.com"; sid:512269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19killer.com"; sid:512270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19killer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19killer.com"; sid:512271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-kit.com"; sid:512272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19kr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19kr.com"; sid:512273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19latest.com"; sid:512274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mail.com"; sid:512275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-masks.com"; sid:512276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19meds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19meds.com"; sid:512277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalcures.com"; sid:512278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19naturalremedies.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19naturalremedies.net"; sid:512279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nearme.com"; sid:512280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nearme.com"; sid:512281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19pharmacy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19pharmacy.com"; sid:512282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19playingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19playingcards.com"; sid:512283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19playingcards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19playingcards.com"; sid:512284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19preventkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19preventkit.com"; sid:512285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-protect.com"; sid:512286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rapidresponse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rapidresponse.com"; sid:512287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rescue.com"; sid:512288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safetymask.com"; sid:512289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19solutions.com"; sid:512290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stat.com"; sid:512291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stop.com"; sid:512292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19supply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19supply.com"; sid:512293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survival.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survival.net"; sid:512294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taskforce.com"; sid:512295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19taskforce.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19taskforce.net"; sid:512296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.com"; sid:512297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19themovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19themovie.com"; sid:512298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-treatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-treatments.com"; sid:512299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-vaccines.com"; sid:512300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vacine.com"; sid:512301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruskit.com"; sid:512302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusnearme.com"; sid:512303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusnearme.com"; sid:512304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19washington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19washington.com"; sid:512305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019-2020.com"; sid:512306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9survivor.com"; sid:512307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcapital.com"; sid:512308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.center"; sid:512309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-corona.com"; sid:512310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-corona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-corona.net"; sid:512311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorona.net"; sid:512312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacemask.com"; sid:512313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree19.com"; sid:512314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfree2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfree2019.com"; sid:512315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-l9.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-l9.com"; sid:512316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmasks.net"; sid:512317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidologist.com"; sid:512318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidology.com"; sid:512319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprev.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprev.com"; sid:512320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpro.com"; sid:512321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-protect.com"; sid:512322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.life"; sid:512323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.net"; sid:512324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidquarantine.com"; sid:512325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsolutions.com"; sid:512326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtaskforce.com"; sid:512327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtrends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtrends.com"; sid:512328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtv.com"; sid:512329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvisualizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvisualizer.com"; sid:512330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforcorona.com"; sid:512331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curesforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curesforcoronavirus.com"; sid:512332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daiyunwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daiyunwuhan.com"; sid:512333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dirittidifesatutelacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dirittidifesatutelacoronavirus.com"; sid:512334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dodoca-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dodoca-covid19.com"; sid:512335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouwantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouwantcoronavirus.com"; sid:512336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easthamptoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easthamptoncovid-19.com"; sid:512337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccrisismanagement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccrisismanagement.com"; sid:512338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccrisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccrisismanagementplan.com"; sid:512339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsupply.com"; sid:512340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for espandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"espandemic.com"; sid:512341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for everythingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"everythingcoronavirus.com"; sid:512342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskcoronaviruses.com"; sid:512343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsoncovid19.com"; sid:512344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid-19.com"; sid:512345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greencorona.com"; sid:512346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haicorona.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haicorona.club"; sid:512347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healingcorona.com"; sid:512348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hetcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hetcoronavirus.com"; sid:512349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihatecoronavirus.com"; sid:512350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecoronavirus.com"; sid:512351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancoronavirus.com"; sid:512352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for irancovidcount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"irancovidcount.com"; sid:512353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiancovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiancovid19free.com"; sid:512354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kalya-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kalya-pandemic.com"; sid:512355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kalya-pandemic-protect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kalya-pandemic-protect.com"; sid:512356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercorona.com"; sid:512357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killercorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killercorona.net"; sid:512358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitanticoronavirus.com"; sid:512359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcorona.com"; sid:512360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcoronavirus.com"; sid:512361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lifeaftercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lifeaftercoronavirus.com"; sid:512362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madeintalycovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madeintalycovid19free.com"; sid:512363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronaabeeragain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronaabeeragain.com"; sid:512364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for makecoronabeeragain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"makecoronabeeragain.com"; sid:512365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascacoronavirus.com"; sid:512366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascaraviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascaraviruscorona.com"; sid:512367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascovid.com"; sid:512368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid19.com"; sid:512369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababies.com"; sid:512370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronababy.com"; sid:512371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronahurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronahurts.com"; sid:512372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirushurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirushurts.com"; sid:512373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycorona.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycorona.wtf"; sid:512374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19news.com"; sid:512375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19story.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19story.com"; sid:512376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nearcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nearcoronavirus.com"; sid:512377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-corona.com"; sid:512378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsoncovid19.com"; sid:512379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for officialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"officialcoronavirus.com"; sid:512380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronatest.com"; sid:512381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for packcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"packcoronavirus.com"; sid:512382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic2021.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic2021.com"; sid:512383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicaftermath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicaftermath.com"; sid:512384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicattack.com"; sid:512385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccrisismanagementplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccrisismanagementplan.com"; sid:512386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergency.com"; sid:512387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyplan.com"; sid:512388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicemergencyresponseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicemergencyresponseplan.com"; sid:512389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichunter.com"; sid:512390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicjobs.com"; sid:512391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiclab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiclab.com"; sid:512392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmeds.com"; sid:512393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicoutpost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicoutpost.com"; sid:512394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplanet.com"; sid:512395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotect.com"; sid:512396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionplan.com"; sid:512397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotectionpolicy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotectionpolicy.com"; sid:512398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreport.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreport.net"; sid:512399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreports.com"; sid:512400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicreports.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicreports.net"; sid:512401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicshop.com"; sid:512402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.international"; sid:512403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicspray.com"; sid:512404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-stop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-stop.com"; sid:512405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicstop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicstop.com"; sid:512406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemics.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemics.world"; sid:512407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicupdates.com"; sid:512408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for panicepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"panicepidemic.com"; sid:512409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for paraelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"paraelcoronavirus.com"; sid:512410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prepare4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prepare4coronavirus.com"; sid:512411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronaviruses.com"; sid:512412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenzionecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenzionecovid-19.com"; sid:512413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prevenzionecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prevenzionecovid.com"; sid:512414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectingyourselffromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectingyourselffromcoronavirus.com"; sid:512415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectingyourselffromcoronavirusnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectingyourselffromcoronavirusnaturally.com"; sid:512416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection4coronavirus.com"; sid:512417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protection4coronavrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protection4coronavrus.com"; sid:512418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyourselffromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyourselffromcoronavirus.com"; sid:512419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectyourselffromcoronavirusnaturally.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectyourselffromcoronavirusnaturally.com"; sid:512420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for purchasecoronavaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"purchasecoronavaccine.com"; sid:512421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ripcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ripcoronavirus.com"; sid:512422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sars-coronavirus-2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sars-coronavirus-2.com"; sid:512423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscoronavirus2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscoronavirus2.com"; sid:512424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shopcoronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shopcoronavirusmask.com"; sid:512425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscoronamask.com"; sid:512426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for spotcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"spotcoronavirus.com"; sid:512427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus2020.com"; sid:512428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus-covid19.com"; sid:512429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivedcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivedcorona.com"; sid:512430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid19.com"; sid:512431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for teebrasilcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"teebrasilcorona.com"; sid:512432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronababies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronababies.com"; sid:512433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronababy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronababy.com"; sid:512434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus19.com"; sid:512435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusbook.com"; sid:512436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscrash.com"; sid:512437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruscure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruscure.net"; sid:512438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaviruskit.com"; sid:512439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirus.wtf - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirus.wtf"; sid:512440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicbox.com"; sid:512441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanvitus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanvitus.com"; sid:512442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumpcorona.com"; sid:512443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trumphascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trumphascoronavirus.com"; sid:512444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidoscontracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidoscontracoronavirus.com"; sid:512445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unidosporcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unidosporcoronavirus.com"; sid:512446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for unitedstatescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"unitedstatescoronavirus.com"; sid:512447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-covid-19.com"; sid:512448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wehavecoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wehavecoronavirusmasks.com"; sid:512449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlemon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlemon.com"; sid:512450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-rent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-rent.com"; sid:512451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xn--coronavirs-iebb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xn--coronavirs-iebb.com"; sid:512452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for yosobrevivialcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"yosobrevivialcoronavirus.com"; sid:512453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapcoronavirus.com"; sid:512454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zapthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zapthecoronavirus.com"; sid:512455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019-covidtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019-covidtest.com"; sid:512456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacoronavirus.com"; sid:512457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidthecoronavirus.com"; sid:512458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona.net"; sid:512459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatthecoronavirus.com"; sid:512460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronamaskofficial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronamaskofficial.com"; sid:512461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestfacemaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestfacemaskforcoronavirus.com"; sid:512462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bitcoinpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bitcoinpandemic.com"; sid:512463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruspill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruspill.com"; sid:512464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19masks.com"; sid:512465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19pill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19pill.com"; sid:512466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for byebyecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"byebyecoronavirus.com"; sid:512467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.club"; sid:512468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.life"; sid:512469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdc-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdc-coronavirus.com"; sid:512470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleaningcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleaningcoronavirus.com"; sid:512471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona123.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona123.com"; sid:512472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-aid.com"; sid:512473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaalertservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaalertservice.com"; sid:512474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaandsun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaandsun.com"; sid:512475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanswers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanswers.com"; sid:512476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaattack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaattack.com"; sid:512477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabioguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabioguard.com"; sid:512478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabust.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabust.com"; sid:512479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareproducts.com"; sid:512480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarrier.com"; sid:512481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaution.com"; sid:512482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckup.com"; sid:512483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacities.com"; sid:512484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoin.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoin.net"; sid:512485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconsultant.com"; sid:512486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorona.com"; sid:512487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountries.com"; sid:512488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19worldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19worldmap.com"; sid:512489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crisis.com"; sid:512490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.biz"; sid:512491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacure.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacure.life"; sid:512492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-desinfektionsmittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-desinfektionsmittel.com"; sid:512493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocapitalgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocapitalgroup.com"; sid:512494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-explained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-explained.com"; sid:512495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafieber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafieber.com"; sid:512496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heilung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heilung.com"; sid:512497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heilung.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heilung.net"; sid:512498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpline.com"; sid:512499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-iran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-iran.com"; sid:512500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakaart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakaart.com"; sid:512501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakarma.com"; sid:512502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivenews.com"; sid:512503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-live-ticker.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-live-ticker.club"; sid:512504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskmap.com"; sid:512505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-medikament.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-medikament.com"; sid:512506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminus.com"; sid:512507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mittel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mittel.com"; sid:512508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamobile.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamobile.com"; sid:512509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews-online.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews-online.com"; sid:512510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapath.com"; sid:512511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapink.com"; sid:512512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapowerrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapowerrx.com"; sid:512513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepbox.com"; sid:512514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotectivesuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotectivesuits.com"; sid:512515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarelieffund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarelieffund.com"; sid:512516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-rescue.com"; sid:512517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresponsesolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresponsesolutions.com"; sid:512518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascreening.com"; sid:512519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasheild.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasheild.com"; sid:512520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmart.com"; sid:512521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stocks.com"; sid:512522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.biz"; sid:512523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona.supply"; sid:512524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronation.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronation.ventures"; sid:512525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatizer.com"; sid:512526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatoken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatoken.com"; sid:512527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacuna.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacuna.com"; sid:512528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavhandwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavhandwash.com"; sid:512529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviro.com"; sid:512530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus18.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus18.com"; sid:512531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19.biz"; sid:512532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19covid19.com"; sid:512533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaccreditation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaccreditation.com"; sid:512534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaction.com"; sid:512535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaldia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaldia.com"; sid:512536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalerts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalerts.net"; sid:512537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalliance.com"; sid:512538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-answers.com"; sid:512539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusattorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusattorneys.com"; sid:512540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbox.com"; sid:512541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrief.com"; sid:512542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbriefing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbriefing.com"; sid:512543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusiness.com"; sid:512544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalculator.com"; sid:512545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalculators.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalculators.com"; sid:512546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscaution.com"; sid:512547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-china.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-china.net"; sid:512548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaneval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaneval.com"; sid:512549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanplan.com"; sid:512550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconcerns.com"; sid:512551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconnect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconnect.com"; sid:512552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19.today"; sid:512553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailybrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailybrief.com"; sid:512554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dans-le-monde.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dans-le-monde.com"; sid:512555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeal.com"; sid:512556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeals.com"; sid:512557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirect.com"; sid:512558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease2019covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease2019covid-19.com"; sid:512559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasepandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasepandemic.com"; sid:512560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisease.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisease.today"; sid:512561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfecting.com"; sid:512562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.email"; sid:512563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-en-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-en-france.com"; sid:512564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescape.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescape.com"; sid:512565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesfacemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesfacemask.net"; sid:512566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseu.com"; sid:512567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevaluation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevaluation.com"; sid:512568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-facemask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-facemask.net"; sid:512569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfarce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfarce.com"; sid:512570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoods.com"; sid:512571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforcemajeure.com"; sid:512572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgermany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgermany.com"; sid:512573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgt.com"; sid:512574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguate.com"; sid:512575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguatemala.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguatemala.com"; sid:512576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandwash.com"; sid:512577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusherbs.com"; sid:512578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.directory - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.directory"; sid:512579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinservice.com"; sid:512580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitaly.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitaly.net"; sid:512581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusit.net"; sid:512582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjapan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjapan.com"; sid:512583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-karma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-karma.com"; sid:512584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskarma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskarma.com"; sid:512585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-viruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-viruskit.com"; sid:512586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskorea.com"; sid:512587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirm.com"; sid:512588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarkets.com"; sid:512589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketwatch.com"; sid:512590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskforsale.com"; sid:512591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.fyi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.fyi"; sid:512592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.mobi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.mobi"; sid:512593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news-and-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news-and-updates.com"; sid:512594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.net"; sid:512595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnutrients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnutrients.com"; sid:512596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspanic.com"; sid:512597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreparednessgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreparednessgroup.com"; sid:512598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepbox.com"; sid:512599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepplan.com"; sid:512600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention911.com"; sid:512601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention.club"; sid:512602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevents.com"; sid:512603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadiness.com"; sid:512604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-report.com"; sid:512605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscarf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscarf.com"; sid:512606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschutz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschutz.net"; sid:512607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshirt.com"; sid:512608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshirts.com"; sid:512609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshop.net"; sid:512610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussoftware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussoftware.com"; sid:512611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthkorea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthkorea.com"; sid:512612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstupidity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstupidity.com"; sid:512613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuisse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuisse.com"; sid:512614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplier.com"; sid:512615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuppliers.com"; sid:512616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.supply - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.supply"; sid:512617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalgear.com"; sid:512618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivordiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivordiaries.com"; sid:512619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorsdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorsdiaries.com"; sid:512620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdater.com"; sid:512621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupd.com"; sid:512622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virususa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virususa.com"; sid:512623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusus.net"; sid:512624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.ventures - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.ventures"; sid:512625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvisit.com"; sid:512626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswatch.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswatch.net"; sid:512627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldoutbreak.com"; sid:512628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxout.com"; sid:512629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavishop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavishop.com"; sid:512630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisit.com"; sid:512631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavit.com"; sid:512632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavmasks.com"; sid:512633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsoap.com"; sid:512634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldnews.com"; sid:512635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-2020.com"; sid:512636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-192020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-192020.com"; sid:512637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-20.com"; sid:512638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19alberta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19alberta.com"; sid:512639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19answers.com"; sid:512640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19answers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19answers.com"; sid:512641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-antivirus.com"; sid:512642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bc.com"; sid:512643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ca.com"; sid:512644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19canada.com"; sid:512645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ca.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ca.net"; sid:512646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19central.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19central.com"; sid:512647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-check.com"; sid:512648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19check.com"; sid:512649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19checklist.com"; sid:512650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19chicago.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19chicago.com"; sid:512651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cities.com"; sid:512652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19countries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19countries.com"; sid:512653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dc.com"; sid:512654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deaths.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deaths.world"; sid:512655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detection.com"; sid:512656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnosis.com"; sid:512657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diaries.com"; sid:512658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diaries.com"; sid:512659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfect.com"; sid:512660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfected.com"; sid:512661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19domains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19domains.com"; sid:512662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19education.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19education.com"; sid:512663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.enterprises - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.enterprises"; sid:512664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epidemia.com"; sid:512665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemia.com"; sid:512666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19epidemic.com"; sid:512667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19epidemic.com"; sid:512668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19familyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19familyguide.com"; sid:512669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forgps.com"; sid:512670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-help.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-help.com"; sid:512671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19help-line.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19help-line.com"; sid:512672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19homecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19homecare.com"; sid:512673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometreatment.com"; sid:512674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hq.com"; sid:512675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19illness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19illness.com"; sid:512676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infolinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infolinks.com"; sid:512677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-japan.com"; sid:512678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lab.com"; sid:512679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19la.com"; sid:512680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19liveworldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19liveworldmap.com"; sid:512681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mexico.com"; sid:512682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ny.com"; sid:512683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ontario.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ontario.com"; sid:512684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-report.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-report.com"; sid:512685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-rescue.com"; sid:512686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19rescue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19rescue.com"; sid:512687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safezones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safezones.com"; sid:512688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screen.com"; sid:512689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sos.com"; sid:512690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19statistics.com"; sid:512691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivors.com"; sid:512692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivors.com"; sid:512693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptom.com"; sid:512694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19symptomrelief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19symptomrelief.com"; sid:512695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tester.com"; sid:512696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testingkits.com"; sid:512697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19therapy.com"; sid:512698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ticker.com"; sid:512699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toronto.com"; sid:512700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19track.com"; sid:512701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tracker.com"; sid:512702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelguide.com"; sid:512703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdate.com"; sid:512704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vsflu.com"; sid:512705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldmap.com"; sid:512706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019cure.com"; sid:512707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-2019test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-2019test.com"; sid:512708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid2019test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid2019test.com"; sid:512709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid247.com"; sid:512710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid25.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid25.com"; sid:512711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid360.com"; sid:512712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid45.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid45.com"; sid:512713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-alert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-alert.com"; sid:512714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantiviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantiviral.com"; sid:512715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidblocker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidblocker.com"; sid:512716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbulletin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbulletin.com"; sid:512717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcentral.com"; sid:512718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheck.com"; sid:512719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.community - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.community"; sid:512720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultant.com"; sid:512721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultants.com"; sid:512722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcures.com"; sid:512723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfact.com"; sid:512724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhoax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhoax.com"; sid:512725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-info.com"; sid:512726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-japan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-japan.com"; sid:512727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedi.com"; sid:512728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmovie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmovie.com"; sid:512729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnomics.com"; sid:512730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpay.com"; sid:512731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplanning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplanning.com"; sid:512732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpurse.com"; sid:512733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-s.email - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-s.email"; sid:512734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupply.com"; sid:512735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivor.com"; sid:512736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.watch - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.watch"; sid:512737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.win - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.win"; sid:512738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronastudy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronastudy.com"; sid:512739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curecoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curecoronavirusnow.com"; sid:512740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cvpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cvpandemic.com"; sid:512741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for designercoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"designercoronavirusmasks.com"; sid:512742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dichbenhcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dichbenhcorona.com"; sid:512743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dogcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dogcoronavirus.com"; sid:512744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecoronavirus.com"; sid:512745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronavirus.net"; sid:512746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiacorona.com"; sid:512747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiceurope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiceurope.com"; sid:512748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-masks.com"; sid:512749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicsituation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicsituation.com"; sid:512750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecovid19.com"; sid:512751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for europeepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"europeepidemic.com"; sid:512752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyecoronaandson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyecoronaandson.com"; sid:512753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eyecoronaandsun.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eyecoronaandsun.com"; sid:512754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facecoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facecoronavirusmasks.com"; sid:512755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsoncovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsoncovid-19.com"; sid:512756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsonpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsonpandemic.com"; sid:512757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for followthecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"followthecorona.com"; sid:512758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for forcemajeurecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"forcemajeurecoronavirus.com"; sid:512759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusalert.com"; sid:512760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid.com"; sid:512761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpwithcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpwithcovid-19.com"; sid:512762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hkcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hkcovid19.com"; sid:512763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoprepareforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoprepareforcoronavirus.com"; sid:512764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcovid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcovid-19.net"; sid:512765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaletracovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaletracovid19.com"; sid:512766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for king-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"king-corona.com"; sid:512767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawcoronavirus.com"; sid:512768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerscoronavirus.com"; sid:512769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronaupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronaupdate.com"; sid:512770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronaupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronaupdates.com"; sid:512771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manmadecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manmadecoronavirus.com"; sid:512772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mapcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mapcovid19.com"; sid:512773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid-19.com"; sid:512774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillascovid19.com"; sid:512775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid-19.com"; sid:512776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid19.com"; sid:512777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskscovid.com"; sid:512778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalog.com"; sid:512779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95coronavirusmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95coronavirusmask.com"; sid:512780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newpandemic.com"; sid:512781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2covid19.com"; sid:512782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no2covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no2covid19.net"; sid:512783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronausa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronausa.com"; sid:512784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nonocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nonocovid.com"; sid:512785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notocovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notocovid-19.com"; sid:512786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notodaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notodaycorona.com"; sid:512787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid.com"; sid:512788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outlastcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outlastcovid19.com"; sid:512789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.agency - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.agency"; sid:512790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicboard.com"; sid:512791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbonds.com"; sid:512792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-dot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-dot.com"; sid:512793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfree.com"; sid:512794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-mask.com"; sid:512795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-masking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-masking.com"; sid:512796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmasking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmasking.com"; sid:512797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-masks.net"; sid:512798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmasks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmasks.net"; sid:512799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpage.com"; sid:512800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicparty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicparty.com"; sid:512801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicservices.com"; sid:512802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.supplies - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.supplies"; sid:512803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pillforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pillforcoronavirus.com"; sid:512804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pinkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pinkcorona.com"; sid:512805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pkcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pkcovid-19.com"; sid:512806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycoronavirus.com"; sid:512807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for precorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"precorona.com"; sid:512808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcoronavirusnow.com"; sid:512809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcovid19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcovid19now.com"; sid:512810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcoronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcoronavirus.world"; sid:512811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionagainstcoronavirus.com"; sid:512812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionandcoronavirus.com"; sid:512813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectionscoronavirus.com"; sid:512814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectmaskcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectmaskcorona.com"; sid:512815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefcovid-19.com"; sid:512816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reliefforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reliefforcovid-19.com"; sid:512817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reportcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reportcovid.com"; sid:512818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for seniorcoronafight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"seniorcoronafight.com"; sid:512819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solvecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solvecoronavirus.com"; sid:512820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for soscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"soscovid.com"; sid:512821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronaspread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronaspread.com"; sid:512822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronavirusoutbreak.com"; sid:512823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcoronavirusoutbreak.com"; sid:512824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for takecovid19pill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"takecovid19pill.com"; sid:512825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronatracker.com"; sid:512826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdaily.com"; sid:512827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusdiaries.com"; sid:512828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusnow.com"; sid:512829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivordiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivordiaries.com"; sid:512830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivors.com"; sid:512831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussurvivorsdiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussurvivorsdiaries.com"; sid:512832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19diaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19diaries.com"; sid:512833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19survivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19survivors.com"; sid:512834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatcoronavirusdisease.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatcoronavirusdisease.com"; sid:512835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for usacoronavirusoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"usacoronavirusoutbreak.com"; sid:512836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for us-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"us-coronavirus.com"; sid:512837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viruscoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viruscoronamap.com"; sid:512838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for viviannincoronato.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"viviannincoronato.com"; sid:512839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whereiscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whereiscorona.com"; sid:512840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willyousurvivecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willyousurvivecovid19.com"; sid:512841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for win-covid-19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"win-covid-19.net"; sid:512842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcorona.com"; sid:512843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldcoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldcoronavirusupdate.com"; sid:512844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanboxes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanboxes.com"; sid:512845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfacemask.com"; sid:512846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhantoutiao.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhantoutiao.com"; sid:512847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanvirusrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanvirusrx.com"; sid:512848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronakill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronakill.com"; sid:512849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronakiller.com"; sid:512850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for zombiecoronapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"zombiecoronapocalypse.com"; sid:512851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 123corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"123corona.com"; sid:512852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020covid19.com"; sid:512853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemic.net"; sid:512854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020pandemic.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020pandemic.today"; sid:512855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 88peopleofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"88peopleofwuhan.com"; sid:512856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acespandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acespandemic.net"; sid:512857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertecoronavirus.com"; sid:512858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcovid19.com"; sid:512859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alphacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alphacoronavirusvaccine.com"; sid:512860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaproducts.com"; sid:512861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronax.com"; sid:512862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotecovid19.com"; sid:512863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotocoronavirus.com"; sid:512864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antidotocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antidotocovid19.com"; sid:512865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiseptic-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiseptic-corona.com"; sid:512866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antivirus-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antivirus-covid19.com"; sid:512867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for asiancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"asiancorona.com"; sid:512868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcorona.com"; sid:512869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatingcoronavirus.com"; sid:512870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becoronavirusfree.com"; sid:512871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcorona.com"; sid:512872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for betacoronavirusvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"betacoronavirusvaccine.com"; sid:512873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bharatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bharatcoronavirus.com"; sid:512874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusfacemasks.com"; sid:512875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for catchcovid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"catchcovid.net"; sid:512876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cegahcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cegahcorona.com"; sid:512877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcorona.com"; sid:512878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid19.com"; sid:512879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcovid.com"; sid:512880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for contra-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"contra-coronavirus.com"; sid:512881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19.biz"; sid:512882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020.club"; sid:512883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirusapocalypse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirusapocalypse.com"; sid:512884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantivirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantivirus.world"; sid:512885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-apparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-apparel.com"; sid:512886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabasics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabasics.com"; sid:512887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablaster.com"; sid:512888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabootcamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabootcamp.com"; sid:512889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuckle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuckle.com"; sid:512890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm.com"; sid:512891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacalm.net"; sid:512892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacamp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacamp.com"; sid:512893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-care24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-care24.com"; sid:512894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacare24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacare24.com"; sid:512895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarepackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarepackage.com"; sid:512896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacase.com"; sid:512897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacatch.com"; sid:512898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacautious.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacautious.com"; sid:512899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacave.com"; sid:512900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclues.com"; sid:512901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacollapse.com"; sid:512902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoping.com"; sid:512903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorner.com"; sid:512904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19virus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19virus.net"; sid:512905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrew.com"; sid:512906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadailyupdates.com"; sid:512907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathpool.com"; sid:512908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetect.com"; sid:512909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetection.com"; sid:512910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diagnostics.com"; sid:512911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiaries.com"; sid:512912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-discount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-discount.com"; sid:512913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocreatives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocreatives.com"; sid:512914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeg.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeg.club"; sid:512915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaegy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaegy.com"; sid:512916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforfuture.com"; sid:512917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebusiness.com"; sid:512918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebusiness.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebusiness.net"; sid:512919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealth-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealth-news.com"; sid:512920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbal.com"; sid:512921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimpact.com"; sid:512922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainisrael.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainisrael.com"; sid:512923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainspected.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainspected.com"; sid:512924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakit.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakit.care"; sid:512925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrise.com"; sid:512926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdates.com"; sid:512927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask-shop.com"; sid:512928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamd.com"; sid:512929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameeting.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameeting.biz"; sid:512930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronan95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronan95.com"; sid:512931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanurse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanurse.com"; sid:512932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemicapp.com"; sid:512933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplace.com"; sid:512934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapocalipsis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapocalipsis.com"; sid:512935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapool.com"; sid:512936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapractical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapractical.com"; sid:512937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprepare.com"; sid:512938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprescriptions.com"; sid:512939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapresident.com"; sid:512940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotection.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotection.care"; sid:512941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-ratgeber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-ratgeber.com"; sid:512942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarecover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarecover.com"; sid:512943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafeway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafeway.com"; sid:512944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizer.com"; sid:512945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasanitizers.com"; sid:512946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasentry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasentry.com"; sid:512947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashots.com"; sid:512948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastat.com"; sid:512949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastuff.com"; sid:512950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-survivor.com"; sid:512951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatemp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatemp.com"; sid:512952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronater.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronater.com"; sid:512953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatesti.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatesti.net"; sid:512954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestlab.com"; sid:512955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatests.com"; sid:512956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathcfreecbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathcfreecbd.com"; sid:512957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronator.com"; sid:512958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-track.com"; sid:512959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatweets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatweets.com"; sid:512960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-updates.com"; sid:512961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaksin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaksin.com"; sid:512962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavanish.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavanish.com"; sid:512963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirenschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirenschutz.com"; sid:512964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisories.com"; sid:512965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisory.com"; sid:512966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-alerts.com"; sid:512967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalysis.com"; sid:512968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusa.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusa.net"; sid:512969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusannouncement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusannouncement.com"; sid:512970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantibiotic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantibiotic.com"; sid:512971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusantidoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusantidoto.com"; sid:512972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapprovedmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapprovedmasks.com"; sid:512973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusapprovedproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusapprovedproducts.com"; sid:512974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbarrier.com"; sid:512975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbcp.com"; sid:512976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtest.com"; sid:512977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessplan.com"; sid:512978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessplans.com"; sid:512979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalm.com"; sid:512980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalm.net"; sid:512981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscare.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscare.today"; sid:512982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscase.com"; sid:512983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscheckup.com"; sid:512984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscities.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscities.com"; sid:512985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningproducts.com"; sid:512986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollege.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollege.com"; sid:512987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultations.com"; sid:512988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscount.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscount.net"; sid:512989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-data.com"; sid:512990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdesignermask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdesignermask.com"; sid:512991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirections.com"; sid:512992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdirectory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdirectory.com"; sid:512993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterplan.com"; sid:512994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisasterplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisasterplans.com"; sid:512995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectants.com"; sid:512996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectants.com"; sid:512997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectantsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectantsoap.com"; sid:512998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectionservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectionservice.com"; sid:512999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctores.com"; sid:513000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctorforfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctorforfree.com"; sid:513001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdr.com"; sid:513002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusecuador.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusecuador.com"; sid:513003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencykit.com"; sid:513004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusespana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusespana.com"; sid:513005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesreadyeducation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesreadyeducation.com"; sid:513006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesvaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesvaccine.com"; sid:513007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevolution.com"; sid:513008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexam.com"; sid:513009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexams.com"; sid:513010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseyeprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseyeprotection.com"; sid:513011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-facemask.com"; sid:513012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfacemasksforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfacemasksforsale.com"; sid:513013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighter.com"; sid:513014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfight.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfight.net"; sid:513015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfl.com"; sid:513016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguard.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguard.net"; sid:513017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheadlines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheadlines.com"; sid:513018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.healthcare - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.healthcare"; sid:513019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthspray.com"; sid:513020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealth.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealth.today"; sid:513021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelponline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelponline.com"; sid:513022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotspot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotspot.com"; sid:513023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusillinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusillinois.com"; sid:513024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.center"; sid:513025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfo.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfo.tips"; sid:513026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinstructions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinstructions.com"; sid:513027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusintel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusintel.com"; sid:513028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinunitedninestates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinunitedninestates.com"; sid:513029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvesting.com"; sid:513030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestments.com"; sid:513031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusireland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusireland.com"; sid:513032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12.com"; sid:513033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12.net"; sid:513034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12prep.com"; sid:513035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusk12safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusk12safety.com"; sid:513036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-live-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-live-update.com"; sid:513037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-location.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-location.com"; sid:513038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslouisiana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslouisiana.com"; sid:513039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasken.com"; sid:513040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaske.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaske.net"; sid:513041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskpeople.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskpeople.com"; sid:513042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksupplier.com"; sid:513043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksupply.com"; sid:513044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusme.com"; sid:513045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalcare.com"; sid:513046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalexam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalexam.com"; sid:513047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalexams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalexams.com"; sid:513048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicalinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicalinfo.com"; sid:513049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmichigan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmichigan.com"; sid:513050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmissouri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmissouri.com"; sid:513051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95facemasks.com"; sid:513052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnearby.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnearby.com"; sid:513053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnear.com"; sid:513054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsbreifing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsbreifing.com"; sid:513055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-news.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-news.today"; sid:513056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnineteen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnineteen.com"; sid:513057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnumber.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnumber.com"; sid:513058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusorg.com"; sid:513059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicapp.com"; sid:513060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemic.world"; sid:513061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphysician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphysician.com"; sid:513062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphysicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphysicians.com"; sid:513063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplan.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplan.net"; sid:513064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusppesupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusppesupply.com"; sid:513065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prepare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prepare.com"; sid:513066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepk12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepk12.com"; sid:513067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepschools.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepschools.com"; sid:513068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprescriptions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprescriptions.com"; sid:513069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspress.com"; sid:513070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionclinic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionclinic.com"; sid:513071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventionproducts.com"; sid:513072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prevention-silver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prevention-silver.com"; sid:513073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.productions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.productions"; sid:513074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofhome.com"; sid:513075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protective-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protective-mask.com"; sid:513076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrd.com"; sid:513077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadyk12.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadyk12.com"; sid:513078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusready.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusready.net"; sid:513079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreceipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreceipe.com"; sid:513080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcecenter.com"; sid:513081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresource.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresource.net"; sid:513082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrn.com"; sid:513083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaftey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaftey.com"; sid:513084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-scandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-scandal.com"; sid:513085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschoolreadiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschoolreadiness.com"; sid:513086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusschutz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusschutz.com"; sid:513087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruss-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruss-covid-19.com"; sid:513088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-secure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-secure.com"; sid:513089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-shield.com"; sid:513090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-shirts.com"; sid:513091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoppinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoppinglist.com"; sid:513092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussite.com"; sid:513093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-skandal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-skandal.com"; sid:513094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-skandal.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-skandal.net"; sid:513095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecialist.com"; sid:513096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecialreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecialreport.com"; sid:513097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstates.com"; sid:513098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussummary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussummary.com"; sid:513099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplykit.com"; sid:513100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorkit.com"; sid:513101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymptomtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymptomtest.com"; sid:513102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteam.com"; sid:513103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustees.com"; sid:513104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestgear.com"; sid:513105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestpack.com"; sid:513106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestskits.com"; sid:513107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustldr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustldr.com"; sid:513108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-track.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-track.com"; sid:513109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrainer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrainer.com"; sid:513110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelkit.com"; sid:513111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreatmentcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreatmentcenters.com"; sid:513112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustx.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustx.net"; sid:513113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-united-states.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-united-states.com"; sid:513114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuniversity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuniversity.com"; sid:513115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-update.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-update.net"; sid:513116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusurlsforsale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusurlsforsale.com"; sid:513117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususnews.com"; sid:513118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvirginia.com"; sid:513119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvolunteers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvolunteers.com"; sid:513120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworld.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworld.world"; sid:513121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirz.com"; sid:513122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawar.com"; sid:513123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawars.com"; sid:513124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for couturecoronation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"couturecoronation.com"; sid:513125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19advisories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19advisories.com"; sid:513126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antidoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antidoto.com"; sid:513127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-antivirus.com"; sid:513128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19antivirus.com"; sid:513129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19canada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19canada.com"; sid:513130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19carebasket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19carebasket.com"; sid:513131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cbd.com"; sid:513132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cbdoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cbdoil.com"; sid:513133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-crisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-crisis.com"; sid:513134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cura.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cura.com"; sid:513135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19data.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19data.net"; sid:513136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-dk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-dk.com"; sid:513137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19feverguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19feverguard.com"; sid:513138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19herbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19herbs.com"; sid:513139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotline.com"; sid:513140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-impfung.com"; sid:513141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-impfung.com"; sid:513142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impfung.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impfung.com"; sid:513143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19infections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19infections.com"; sid:513144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19insight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19insight.com"; sid:513145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19list.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19list.com"; sid:513146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19masks.net"; sid:513147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19masks.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19masks.net"; sid:513148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medicines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medicines.com"; sid:513149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19monitor.com"; sid:513150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19numbers.com"; sid:513151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19oil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19oil.com"; sid:513152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prep.com"; sid:513153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19prepping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19prepping.com"; sid:513154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19protocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19protocol.com"; sid:513155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.school - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.school"; sid:513156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screening.com"; sid:513157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stack.com"; sid:513158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stocks.com"; sid:513159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survivor.com"; sid:513160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tent.com"; sid:513161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testgear.com"; sid:513162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapeutics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapeutics.com"; sid:513163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-therapy.com"; sid:513164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19therapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19therapy.com"; sid:513165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thermoscan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thermoscan.com"; sid:513166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19videos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19videos.com"; sid:513167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusprotection.com"; sid:513168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19worldpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19worldpandemic.com"; sid:513169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20guide.com"; sid:513170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20info.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20info.com"; sid:513171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid20preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid20preparation.com"; sid:513172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidauthority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidauthority.com"; sid:513173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidclean.com"; sid:513174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcombat.com"; sid:513175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontroversy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontroversy.com"; sid:513176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrisis.com"; sid:513177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddoesnotcausedeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddoesnotcausedeath.com"; sid:513178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfunding.com"; sid:513179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidgame.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidgame.com"; sid:513180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguide.com"; sid:513181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidincome.com"; sid:513182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidjobs.com"; sid:513183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmap.net"; sid:513184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmascarillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmascarillas.com"; sid:513185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedicines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedicines.com"; sid:513186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedsupplies.com"; sid:513187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmoney.com"; sid:513188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidome.com"; sid:513189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpreparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpreparation.com"; sid:513190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistance.com"; sid:513191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidresistancemovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidresistancemovement.com"; sid:513192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-s.com"; sid:513193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstar.com"; sid:513194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstore.com"; sid:513195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtent.com"; sid:513196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-test.com"; sid:513197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.tips - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.tips"; sid:513198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusalerts.com"; sid:513199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirusnews.com"; sid:513200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curacovid19.com"; sid:513201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curewuhanvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curewuhanvirus.com"; sid:513202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycovid19.com"; sid:513203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decontamination-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decontamination-coronavirus.com"; sid:513204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfection-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfection-corona.com"; sid:513205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doctorforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doctorforcoronavirus.com"; sid:513206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drugcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drugcorona.com"; sid:513207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for educationcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"educationcovid19.com"; sid:513208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-coronavirus.com"; sid:513209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for end-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"end-coronavirus.net"; sid:513210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronavirus.net"; sid:513211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiacovid19.com"; sid:513212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicalerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicalerts.com"; sid:513213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccentral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccentral.com"; sid:513214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicclaims.com"; sid:513215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemiccoverageclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemiccoverageclaims.com"; sid:513216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemichq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemichq.com"; sid:513217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicupdates.com"; sid:513218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemask-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemask-coronavirus.com"; sid:513219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for facemaskforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"facemaskforcoronavirus.com"; sid:513220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckthecoronavirus.com"; sid:513221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gearcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gearcorona.com"; sid:513222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronasafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronasafe.com"; sid:513223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for healcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"healcovid19.com"; sid:513224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for help-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"help-covid19.com"; sid:513225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcorona.com"; sid:513226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpfightcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpfightcoronavirus.com"; sid:513227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for herbalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"herbalcorona.com"; sid:513228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hey-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hey-covid.com"; sid:513229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heycovid.com"; sid:513230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopreventthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopreventthecoronavirus.com"; sid:513231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoprotectagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoprotectagainstcoronavirus.com"; sid:513232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcoronavirusfree.com"; sid:513233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamcovid19free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamcovid19free.com"; sid:513234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icoronaclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icoronaclean.com"; sid:513235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacovid.com"; sid:513236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for intowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"intowuhan.com"; sid:513237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthecoronavirusinflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthecoronavirusinflorida.com"; sid:513238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for italiancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"italiancoronavirus.com"; sid:513239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jorcorona.com"; sid:513240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirus.com"; sid:513241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirusprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirusprep.com"; sid:513242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirusreadiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirusreadiness.com"; sid:513243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k12coronavirussafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k12coronavirussafety.com"; sid:513244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-pandemic.com"; sid:513245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lacoronadela11.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lacoronadela11.com"; sid:513246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for littlecoronaking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"littlecoronaking.com"; sid:513247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecoronavirusupdates.com"; sid:513248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveintheageofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveintheageofcoronavirus.com"; sid:513249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcorona.com"; sid:513250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid.com"; sid:513251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for map-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"map-covid.com"; sid:513252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarilla-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarilla-corona-virus.com"; sid:513253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarilla-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarilla-coronavirus.com"; sid:513254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillas-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillas-coronavirus.net"; sid:513255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask-ffp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask-ffp-coronavirus.com"; sid:513256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcovid19.com"; sid:513257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskofcorona.com"; sid:513258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-ffp-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-ffp-coronavirus.com"; sid:513259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for matchcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"matchcorona.com"; sid:513260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencegahcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencegahcoronavirus.com"; sid:513261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mencegahviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mencegahviruscorona.com"; sid:513262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mosaicovidal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mosaicovidal.com"; sid:513263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronacure.com"; sid:513264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakit.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakit.biz"; sid:513265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirusdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirusdefense.com"; sid:513266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturalcoronavirussolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturalcoronavirussolution.com"; sid:513267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona.business - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona.business"; sid:513268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for no-more-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"no-more-corona.com"; sid:513269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatantiviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatantiviruscorona.com"; sid:513270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcorona.com"; sid:513271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcoronavirus.com"; sid:513272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatcovid19.com"; sid:513273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatherbalviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatherbalviruscorona.com"; sid:513274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for obatviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"obatviruscorona.com"; sid:513275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupationalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupationalcorona.com"; sid:513276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupationalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupationalcoronavirus.com"; sid:513277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occupationalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occupationalcovid19.com"; sid:513278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicapp.com"; sid:513279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessplan.com"; sid:513280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbusinessplans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbusinessplans.com"; sid:513281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccalm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccalm.com"; sid:513282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccalm.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccalm.net"; sid:513283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdays.com"; sid:513284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdisasterplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdisasterplan.com"; sid:513285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichideaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichideaway.com"; sid:513286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiciq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiciq.com"; sid:513287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicmap.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicmap.net"; sid:513288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiconsultants.com"; sid:513289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicprotocol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicprotocol.com"; sid:513290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresourcecenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresourcecenter.com"; sid:513291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicresponses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicresponses.com"; sid:513292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivors.com"; sid:513293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pencegahancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pencegahancorona.com"; sid:513294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for peopleofwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"peopleofwuhan.com"; sid:513295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for prep4pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"prep4pandemic.com"; sid:513296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for preventcorona.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"preventcorona.net"; sid:513297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realestatesouthcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realestatesouthcorona.com"; sid:513298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for resist-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"resist-corona.com"; sid:513299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for reycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"reycorona.com"; sid:513300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ridcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ridcovid19.com"; sid:513301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for roomingwithcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"roomingwithcovid19.com"; sid:513302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for safety-precautions-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"safety-precautions-coronavirus.com"; sid:513303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscoronavirus19.com"; sid:513304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for sarscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"sarscovid19.com"; sid:513305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for schoolsafecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"schoolsafecoronavirus.com"; sid:513306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for siagacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"siagacorona.com"; sid:513307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solusicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solusicoronavirus.com"; sid:513308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for solusiviruscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"solusiviruscorona.com"; sid:513309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcorona-virus.com"; sid:513310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stop-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stop-coronavirus.net"; sid:513311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcovid.com"; sid:513312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for t9coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"t9coronavirus.com"; sid:513313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telehealthforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telehealthforthecoronavirus.com"; sid:513314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for telemedicineforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"telemedicineforthecoronavirus.com"; sid:513315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for test-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"test-covid19.com"; sid:513316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testingcovid19.com"; sid:513317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronadiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronadiaries.com"; sid:513318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecorona.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecorona.network"; sid:513319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirusplague.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirusplague.com"; sid:513320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirustips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirustips.com"; sid:513321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidresistance.com"; sid:513322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidresistancemovement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidresistancemovement.com"; sid:513323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thegruppandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thegruppandemic.com"; sid:513324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicpantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicpantry.com"; sid:513325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicreport.com"; sid:513326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thepandemicreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thepandemicreports.com"; sid:513327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thetruthaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thetruthaboutcorona.com"; sid:513328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tolakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tolakcorona.com"; sid:513329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcorona.com"; sid:513330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for topcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"topcoronamask.com"; sid:513331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for trackcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"trackcoronanow.com"; sid:513332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for treatmentforcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"treatmentforcovid-19.com"; sid:513333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for umsatz-trotz-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"umsatz-trotz-coronavirus.com"; sid:513334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for updatescoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"updatescoronavirus.com"; sid:513335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vaksincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vaksincorona.com"; sid:513336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virucorona.com"; sid:513337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for virus-coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"virus-coronamask.com"; sid:513338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscoronacure.com"; sid:513339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for whatiscoronaviruscure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"whatiscoronaviruscure.com"; sid:513340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for willcoronaviruskillme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"willcoronaviruskillme.com"; sid:513341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemiccovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemiccovid-19.com"; sid:513342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldpandemiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldpandemiccovid.com"; sid:513343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid-19.com"; sid:513344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovid.com"; sid:513345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwidecovidpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwidecovidpandemic.com"; sid:513346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwideepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwideepidemic.com"; sid:513347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for worldwideepidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"worldwideepidemics.com"; sid:513348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhancunluo.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhancunluo.club"; sid:513349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanfp163.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanfp163.com"; sid:513350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanviral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanviral.com"; sid:513351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for xcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"xcoronavirus.com"; sid:513352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2019coronavirusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2019coronavirusinfo.com"; sid:513353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 2020corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"2020corona.com"; sid:513354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for againstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"againstcorona.com"; sid:513355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for allaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"allaboutcorona.com"; sid:513356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaherbs.com"; sid:513357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronameds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronameds.com"; sid:513358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronashop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronashop.net"; sid:513359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaspray.com"; sid:513360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusdiet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusdiet.com"; sid:513361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusplan.com"; sid:513362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusproductions.com"; sid:513363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusspray.com"; sid:513364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid19.com"; sid:513365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antycovid.com"; sid:513366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arwuhan.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arwuhan.club"; sid:513367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcoronavirus.net"; sid:513368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronasanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronasanitizer.com"; sid:513369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blameitoncorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blameitoncorona.com"; sid:513370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brotecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brotecoronavirus.com"; sid:513371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brotecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brotecovid19.com"; sid:513372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for carte-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"carte-coronavirus.com"; sid:513373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cleancovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cleancovid.com"; sid:513374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cokecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cokecorona.com"; sid:513375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-advice.com"; sid:513376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaids.com"; sid:513377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-alertz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-alertz.com"; sid:513378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaarmageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaarmageddon.com"; sid:513379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabase.com"; sid:513380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeskyttelse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeskyttelse.com"; sid:513381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabets.com"; sid:513382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabetting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabetting.com"; sid:513383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabinoid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabinoid.com"; sid:513384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabinoid.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabinoid.net"; sid:513385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabracelets.com"; sid:513386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrain.com"; sid:513387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrains.com"; sid:513388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabugs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabugs.com"; sid:513389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacar.com"; sid:513390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacareful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacareful.com"; sid:513391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacat.com"; sid:513392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacats.com"; sid:513393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronace.com"; sid:513394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacell.com"; sid:513395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacells.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacells.com"; sid:513396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacenters.com"; sid:513397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachecks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachecks.com"; sid:513398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckups.com"; sid:513399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoffees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoffees.com"; sid:513400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoke.com"; sid:513401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoms.com"; sid:513402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-consultancy.com"; sid:513403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontact.com"; sid:513404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontact.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontact.net"; sid:513405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontacts.com"; sid:513406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacough.com"; sid:513407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoughs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoughs.com"; sid:513408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrusher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrusher.com"; sid:513409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacryptos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacryptos.com"; sid:513410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrystals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrystals.com"; sid:513411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurb.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurb.club"; sid:513412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadaddy.com"; sid:513413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaddicted.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaddicted.com"; sid:513414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadefenceminerals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadefenceminerals.com"; sid:513415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadie.com"; sid:513416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadies.com"; sid:513417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfecting.com"; sid:513418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadobros.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadobros.com"; sid:513419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadohandymanllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadohandymanllc.com"; sid:513420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadomain.com"; sid:513421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrinks.com"; sid:513422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaearth.com"; sid:513423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaemergencykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaemergencykit.com"; sid:513424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaenergies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaenergies.com"; sid:513425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaface.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaface.com"; sid:513426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-facts.com"; sid:513427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafevers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafevers.com"; sid:513428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafiles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafiles.com"; sid:513429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-forum.com"; sid:513430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreetravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreetravel.com"; sid:513431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronah2o.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronah2o.com"; sid:513432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandwash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandwash.com"; sid:513433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealth.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealth.club"; sid:513434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.center"; sid:513435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahospitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahospitals.com"; sid:513436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahub.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahub.club"; sid:513437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaids.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaids.com"; sid:513438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunedefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunedefence.com"; sid:513439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunehealth.com"; sid:513440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimmunisation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimmunisation.com"; sid:513441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infections.com"; sid:513442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajobza.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajobza.com"; sid:513443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajoke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajoke.com"; sid:513444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajokes.com"; sid:513445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakid.com"; sid:513446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakil.com"; sid:513447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakiss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakiss.com"; sid:513448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakisses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakisses.com"; sid:513449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakitten.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakitten.com"; sid:513450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakittens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakittens.com"; sid:513451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-krise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-krise.com"; sid:513452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakrypto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakrypto.com"; sid:513453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalinks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalinks.com"; sid:513454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalives.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalives.com"; sid:513455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-map.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-map.net"; sid:513456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskdirect.com"; sid:513457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasksdirect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasksdirect.com"; sid:513458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamind.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamind.com"; sid:513459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaminds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaminds.com"; sid:513460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamineral.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamineral.com"; sid:513461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneedle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneedle.com"; sid:513462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneedles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneedles.com"; sid:513463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.today - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.today"; sid:513464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanomics.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanomics.net"; sid:513465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanuclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanuclear.com"; sid:513466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanutrient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanutrient.com"; sid:513467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanutrients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanutrients.com"; sid:513468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorfashion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorfashion.com"; sid:513469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoxygen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoxygen.com"; sid:513470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatches.com"; sid:513471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapedia.com"; sid:513472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaphona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaphona.com"; sid:513473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanet.com"; sid:513474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapowers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapowers.com"; sid:513475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprediction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprediction.com"; sid:513476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotein.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotein.com"; sid:513477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproteins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproteins.com"; sid:513478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquil.com"; sid:513479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarace.com"; sid:513480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaraces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaraces.com"; sid:513481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarehabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarehabs.com"; sid:513482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepair.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepair.com"; sid:513483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepairs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepairs.com"; sid:513484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarmageddon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarmageddon.com"; sid:513485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronartvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronartvirus.com"; sid:513486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaglikkiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaglikkiti.com"; sid:513487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschutzvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschutzvirus.com"; sid:513488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseal.com"; sid:513489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashake.com"; sid:513490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashakes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashakes.com"; sid:513491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasick.com"; sid:513492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasirup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasirup.com"; sid:513493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasirups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasirups.com"; sid:513494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasites.com"; sid:513495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslayer.com"; sid:513496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoaps.com"; sid:513497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspirit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspirit.com"; sid:513498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspirits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspirits.com"; sid:513499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprays.com"; sid:513500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspring.com"; sid:513501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasprings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasprings.com"; sid:513502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastations.com"; sid:513503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastl.com"; sid:513504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasucks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasucks.com"; sid:513505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplements.com"; sid:513506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-supplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-supplies.com"; sid:513507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplykit.com"; sid:513508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvival.guide - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvival.guide"; sid:513509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasyrup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasyrup.com"; sid:513510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasyrups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasyrups.com"; sid:513511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatab.com"; sid:513512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatablets.com"; sid:513513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatabs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatabs.com"; sid:513514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatea.com"; sid:513515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelegraph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelegraph.com"; sid:513516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatragedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatragedy.com"; sid:513517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatreatmentinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatreatmentinfo.com"; sid:513518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrial.com"; sid:513519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrials.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrials.com"; sid:513520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaunits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaunits.com"; sid:513521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavid19.net"; sid:513522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinus.com"; sid:513523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirals.com"; sid:513524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviras.com"; sid:513525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirdata.com"; sid:513526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirous.com"; sid:513527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020areyouprepared.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020areyouprepared.club"; sid:513528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus7.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus7.com"; sid:513529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafrica.com"; sid:513530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusaid.com"; sid:513531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalgeria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalgeria.com"; sid:513532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusandtrump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusandtrump.com"; sid:513533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-api.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-api.com"; sid:513534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblockers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblockers.com"; sid:513535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbugoutkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbugoutkit.com"; sid:513536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuster.com"; sid:513537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalifornia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalifornia.net"; sid:513538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareful.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareful.com"; sid:513539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschampion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschampion.com"; sid:513540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschat.com"; sid:513541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaninganddisinfecting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaninganddisinfecting.com"; sid:513542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningnewyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningnewyork.com"; sid:513543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservice.com"; sid:513544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanups.com"; sid:513545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinic.net"; sid:513546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscme.com"; sid:513547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommercialcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommercialcleaning.com"; sid:513548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-consultancy.com"; sid:513549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultancy.com"; sid:513550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-consulting.com"; sid:513551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoping.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoping.solutions"; sid:513552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19test.com"; sid:513553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovidadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovidadvisors.com"; sid:513554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruise.com"; sid:513555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscures.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscures.net"; sid:513556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailyupdates.com"; sid:513557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdata.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdata.world"; sid:513558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdays.com"; sid:513559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-db.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-db.com"; sid:513560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdb.com"; sid:513561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenseplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenseplan.com"; sid:513562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensesystem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensesystem.com"; sid:513563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisenfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisenfectant.com"; sid:513564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectant.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectant.net"; sid:513565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectors.com"; sid:513566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisinfectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisinfectors.com"; sid:513567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiy.com"; sid:513568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdoctoronline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdoctoronline.com"; sid:513569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusengland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusengland.com"; sid:513570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruses.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruses.world"; sid:513571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfoundations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfoundations.com"; sid:513572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-france.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-france.net"; sid:513573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfyi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfyi.com"; sid:513574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusga.com"; sid:513575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgel.com"; sid:513576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeorgia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeorgia.com"; sid:513577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguidance.com"; sid:513578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandgel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandgel.com"; sid:513579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanatiser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanatiser.com"; sid:513580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsanatizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsanatizer.com"; sid:513581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushazmatsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushazmatsuit.com"; sid:513582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthcenter.com"; sid:513583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushk.com"; sid:513584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushoppinglist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushoppinglist.com"; sid:513585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindia.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindia.net"; sid:513586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiran.com"; sid:513587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusissue.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusissue.com"; sid:513588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusissues.com"; sid:513589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-italy.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-italy.net"; sid:513590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-latest.com"; sid:513591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-latest-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-latest-update.com"; sid:513592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-law.com"; sid:513593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslaws.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslaws.com"; sid:513594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-litigation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-litigation.com"; sid:513595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmainpage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmainpage.com"; sid:513596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalpractice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalpractice.com"; sid:513597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskshop.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskshop.net"; sid:513598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasks.international - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasks.international"; sid:513599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmask.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmask.solutions"; sid:513600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskss.com"; sid:513601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksstore.com"; sid:513602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-monitoring.com"; sid:513603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmx.com"; sid:513604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusn95ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusn95ppe.com"; sid:513605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnederland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnederland.com"; sid:513606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnedir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnedir.com"; sid:513607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneeds.com"; sid:513608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnj.com"; sid:513609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnursing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnursing.com"; sid:513610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspa.com"; sid:513611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-ppe.com"; sid:513612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspress.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspress.net"; sid:513613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevencion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevencion.com"; sid:513614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproguard.com"; sid:513615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotectioninformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotectioninformation.com"; sid:513616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusregulations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusregulations.com"; sid:513617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-remedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-remedies.com"; sid:513618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusri.com"; sid:513619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrussia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrussia.com"; sid:513620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussa.com"; sid:513621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyguide.com"; sid:513622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafety.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafety.net"; sid:513623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseattle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseattle.com"; sid:513624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-security.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-security.com"; sid:513625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussenegal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussenegal.com"; sid:513626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopping.com"; sid:513627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspain.com"; sid:513628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussponge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussponge.com"; sid:513629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstock.com"; sid:513630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.style - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.style"; sid:513631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplyshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplyshop.com"; sid:513632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-survivalkit.com"; sid:513633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustesting.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustesting.net"; sid:513634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackers.com"; sid:513635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrips.com"; sid:513636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustt.com"; sid:513637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuniverse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuniverse.com"; sid:513638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.biz"; sid:513639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdatesindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdatesindia.com"; sid:513640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirususworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirususworldwide.com"; sid:513641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccino.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccino.net"; sid:513642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswebapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswebapp.com"; sid:513643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world-status.com"; sid:513644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswrongfuldeath.com"; sid:513645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.xn--9dbq2a - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.xn--9dbq2a"; sid:513646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.xn--tckwe - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.xn--tckwe"; sid:513647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirys.com"; sid:513648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavisionrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavisionrx.com"; sid:513649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitamin.com"; sid:513650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavitamins.com"; sid:513651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavsflu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavsflu.com"; sid:513652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarrior.com"; sid:513653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawarriors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawarriors.com"; sid:513654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawash.com"; sid:513655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19aid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19aid.com"; sid:513656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19blog.com"; sid:513657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19checklist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19checklist.com"; sid:513658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-china.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-china.com"; sid:513659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clean.com"; sid:513660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comedy.com"; sid:513661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coping.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coping.solutions"; sid:513662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cure.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cure.net"; sid:513663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dailyupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dailyupdates.com"; sid:513664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-data.com"; sid:513665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19deepclean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19deepclean.com"; sid:513666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19dr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19dr.com"; sid:513667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19eval.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19eval.com"; sid:513668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evaluation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evaluation.com"; sid:513669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19evolution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19evolution.com"; sid:513670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-forum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-forum.com"; sid:513671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-fr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-fr.com"; sid:513672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19.graphics - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19.graphics"; sid:513673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hazmatsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hazmatsuit.com"; sid:513674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometest.com"; sid:513675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-immunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-immunity.com"; sid:513676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19law.com"; sid:513677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19llc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19llc.net"; sid:513678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19llc.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19llc.net"; sid:513679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-monitoring.com"; sid:513680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19nyc.com"; sid:513681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-pandemic.com"; sid:513682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.life"; sid:513683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemic.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemic.net"; sid:513684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19party.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19party.com"; sid:513685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pharma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pharma.com"; sid:513686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physician.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physician.com"; sid:513687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19physicians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19physicians.com"; sid:513688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19questions.com"; sid:513689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19relief.com"; sid:513690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19s.com"; sid:513691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19specialists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19specialists.com"; sid:513692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-survivalkit.com"; sid:513693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalsquad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalsquad.com"; sid:513694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telehealth.com"; sid:513695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19telemedicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19telemedicine.com"; sid:513696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19th.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19th.com"; sid:513697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19times.com"; sid:513698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tip.com"; sid:513699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virus.solutions"; sid:513700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19warnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19warnings.com"; sid:513701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warnings.com"; sid:513702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19x.com"; sid:513703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanddead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanddead.com"; sid:513704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consultancy.com"; sid:513705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsultancy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsultancy.com"; sid:513706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-consulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-consulting.com"; sid:513707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsulting.com"; sid:513708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcontrol.com"; sid:513709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddata.com"; sid:513710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-epidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-epidemic.com"; sid:513711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideumap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideumap.com"; sid:513712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidineu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidineu.com"; sid:513713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-information.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-information.com"; sid:513714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinworld.com"; sid:513715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlocator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlocator.com"; sid:513716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masque.com"; sid:513717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpack.com"; sid:513718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-pandemic.com"; sid:513719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-prevention.com"; sid:513720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproductions.com"; sid:513721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotect.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotect.biz"; sid:513722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.report - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.report"; sid:513723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsmart.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsmart.com"; sid:513724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsos.com"; sid:513725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstat.com"; sid:513726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstores.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstores.com"; sid:513727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtester.com"; sid:513728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-tests.com"; sid:513729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.com"; sid:513730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtests.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtests.net"; sid:513731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidus.com"; sid:513732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidworld.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidworld.com"; sid:513733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptocoronas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptocoronas.com"; sid:513734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ctcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ctcoronavirus.com"; sid:513735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deathcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deathcovid19.com"; sid:513736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectantecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectantecoronavirus.com"; sid:513737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for diagnosecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"diagnosecovid19.com"; sid:513738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for disinfectingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"disinfectingcoronavirus.com"; sid:513739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donatecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donatecovid19.com"; sid:513740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emdadcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emdadcorona.com"; sid:513741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for factsaboutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"factsaboutcoronavirus.com"; sid:513742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fatalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fatalcoronavirus.com"; sid:513743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fdacoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fdacoronavirustestkit.com"; sid:513744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcovid.com"; sid:513745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fixcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fixcorona.com"; sid:513746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flucovid19.com"; sid:513747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flucovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flucovid.com"; sid:513748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucovid19.com"; sid:513749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgecoronadomortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgecoronadomortgage.com"; sid:513750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronamask.com"; sid:513751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getreadycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getreadycovid19.com"; sid:513752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusalliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusalliance.com"; sid:513753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19alliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19alliance.com"; sid:513754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalpandemicorganization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalpandemicorganization.com"; sid:513755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for global-status-of-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"global-status-of-coronavirus.com"; sid:513756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hcovid19.com"; sid:513757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpstopcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpstopcorona.com"; sid:513758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hotelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hotelcoronavirus.com"; sid:513759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoavoidcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoavoidcorona.com"; sid:513760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtotreatcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtotreatcorona.com"; sid:513761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for huiwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"huiwuhan.com"; sid:513762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirusprotectionkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirusprotectionkit.com"; sid:513763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for humancoronavirusprotectionkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"humancoronavirusprotectionkit.net"; sid:513764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iamacoronasurvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iamacoronasurvivor.com"; sid:513765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infectionscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infectionscoronavirus.com"; sid:513766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for info-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"info-covid-19.com"; sid:513767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informationcoronavirus.com"; sid:513768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isthiscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isthiscovid19.com"; sid:513769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jesuscoronado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jesuscoronado.com"; sid:513770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killscoronavirus.com"; sid:513771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirus.com"; sid:513772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestcoronavirusupdates.com"; sid:513773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lethalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lethalcoronavirus.com"; sid:513774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for libredecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"libredecoronavirus.com"; sid:513775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingcoronavirusfree.com"; sid:513776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lovecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lovecorona.com"; sid:513777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for loveinthetimeofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"loveinthetimeofcovid19.com"; sid:513778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for luojiashanhotelwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"luojiashanhotelwuhan.com"; sid:513779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macorona.com"; sid:513780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4coronavirus.com"; sid:513781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masque-pour-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masque-pour-coronavirus.com"; sid:513782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mypandemicprep.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mypandemicprep.com"; sid:513783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcovid19.com"; sid:513784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for navigatingcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"navigatingcovid.com"; sid:513785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newsaboutcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newsaboutcovid19.com"; sid:513786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for news-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"news-corona.com"; sid:513787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for opencoronavirusapi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"opencoronavirusapi.com"; sid:513788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicactionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicactionplan.com"; sid:513789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicbarrier.com"; sid:513790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicblueprint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicblueprint.com"; sid:513791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic.care - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic.care"; sid:513792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccv.com"; sid:513793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfence.com"; sid:513794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimmunedefence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimmunedefence.com"; sid:513795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicplaybook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicplaybook.com"; sid:513796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparationbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparationbook.com"; sid:513797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-preparation.com"; sid:513798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicpreparednesssurvivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicpreparednesssurvivalkit.com"; sid:513799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsupermarket.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsupermarket.com"; sid:513800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsuppliers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsuppliers.com"; sid:513801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicvaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicvaccines.com"; sid:513802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicwarnings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicwarnings.com"; sid:513803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for patentedcoronaviruscleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"patentedcoronaviruscleaner.com"; sid:513804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for praycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"praycovid19.com"; sid:513805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productosparaprevenirelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productosparaprevenirelcoronavirus.com"; sid:513806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productsforcoronavirus.com"; sid:513807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for productstopreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"productstopreventcoronavirus.com"; sid:513808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protectcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protectcovid-19.com"; sid:513809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for protegerse-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"protegerse-coronavirus.com"; sid:513810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovid-19.com"; sid:513811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for psicovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"psicovid19.com"; sid:513812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for realcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"realcorona.com"; sid:513813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for redcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"redcovid19.com"; sid:513814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for screwcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"screwcorona.com"; sid:513815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for security-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"security-coronavirus.com"; sid:513816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stayawaycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stayawaycoronavirus.com"; sid:513817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stlcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stlcorona.com"; sid:513818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcoronavirus.solutions - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcoronavirus.solutions"; sid:513819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for stopcovid.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"stopcovid.world"; sid:513820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivecoronavirus.net"; sid:513821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survivingcorona2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survivingcorona2020.com"; sid:513822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for techagainstcoronavir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"techagainstcoronavir.com"; sid:513823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for testforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"testforcovid19.com"; sid:513824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thebestcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thebestcoronamask.com"; sid:513825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaantivirus.com"; sid:513826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanetwork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanetwork.com"; sid:513827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronanetwork.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronanetwork.net"; sid:513828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronaradar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronaradar.com"; sid:513829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronareport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronareport.com"; sid:513830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for the-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"the-coronavirus.com"; sid:513831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronavirussymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronavirussymptoms.com"; sid:513832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecoronayouwant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecoronayouwant.com"; sid:513833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovid19times.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovid19times.com"; sid:513834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thecovidvirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thecovidvirus.com"; sid:513835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanshake.com"; sid:513836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for thewuhanshake.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"thewuhanshake.net"; sid:513837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for tieqiaojianguowuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"tieqiaojianguowuhan.com"; sid:513838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for turmericforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"turmericforcoronavirus.com"; sid:513839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ukcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ukcovid-19.com"; sid:513840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusdeaths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusdeaths.com"; sid:513841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for uscoronavirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"uscoronavirusupdate.com"; sid:513842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vcorona.com"; sid:513843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for veganpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"veganpandemic.com"; sid:513844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for vitaminsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"vitaminsforcoronavirus.com"; sid:513845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wahkiakumcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wahkiakumcovid19.com"; sid:513846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for warroompandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"warroompandemic.com"; sid:513847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for westopcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"westopcoronavirus.com"; sid:513848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wincovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wincovid.com"; sid:513849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanganmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanganmo.com"; sid:513850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanlotto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanlotto.com"; sid:513851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhan-shake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhan-shake.com"; sid:513852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanshake.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanshake.com"; sid:513853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidmasks.com"; sid:513854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-crash.com"; sid:513855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrink.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrink.com"; sid:513856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarehabilitation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarehabilitation.com"; sid:513857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplement.com"; sid:513858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirs.com"; sid:513859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmapper.com"; sid:513860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusperu.com"; sid:513861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cases.com"; sid:513862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19llc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19llc.com"; sid:513863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19llc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19llc.com"; sid:513864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideu.com"; sid:513865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskshop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskshop.com"; sid:513866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for juliacoronadoking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"juliacoronadoking.com"; sid:513867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for logosunhotelwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"logosunhotelwuhan.com"; sid:513868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for shop-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"shop-coronavirus.com"; sid:513869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanhuachengedu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanhuachengedu.com"; sid:513870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 19covidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"19covidmask.com"; sid:513871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadocounselingca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadocounselingca.com"; sid:513872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetypack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetypack.com"; sid:513873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrategy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrategy.com"; sid:513874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustechhandbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustechhandbook.com"; sid:513875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-corona-shop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-corona-shop.com"; sid:513876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashit.com"; sid:513877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-2020.com"; sid:513878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcovid-19.com"; sid:513879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemorial.com"; sid:513880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19memorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19memorial.com"; sid:513881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-numbers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-numbers.com"; sid:513882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19onlinedr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19onlinedr.com"; sid:513883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19ppe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19ppe.com"; sid:513884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecoronavirus.com"; sid:513885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronalight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronalight.com"; sid:513886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for survive-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"survive-coronavirus.com"; sid:513887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for v-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"v-covid-19.com"; sid:513888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for wuhanavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"wuhanavirus.com"; sid:513889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyproduct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyproduct.com"; sid:513890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicsurvivals.bid - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicsurvivals.bid"; sid:513891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1800covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1800covid19.com"; sid:513892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 1coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"1coronavirus.com"; sid:513893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411coronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411coronacash.com"; sid:513894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 411corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"411corona.com"; sid:513895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 4anticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"4anticoronavirus.com"; sid:513896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 87corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"87corona.com"; sid:513897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 88covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"88covid19.com"; sid:513898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911coronacash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911coronacash.com"; sid:513899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911corona.com"; sid:513900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for 911coronaoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"911coronaoutbreak.com"; sid:513901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for abogadodecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"abogadodecoronavirus.com"; sid:513902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for about-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"about-coronavirus.com"; sid:513903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aboutcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aboutcovid.com"; sid:513904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for acovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"acovid19.com"; sid:513905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for adioscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"adioscorona.com"; sid:513906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for afghanistancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"afghanistancoronavirus.com"; sid:513907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for africacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"africacoronavirus.com"; sid:513908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aidecoronavirus.com"; sid:513909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for akcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"akcoronavirus.com"; sid:513910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alabamacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alabamacoronavirus.com"; sid:513911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alaskacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alaskacoronavirus.com"; sid:513912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for albuquerquecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"albuquerquecoronavirus.com"; sid:513913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alcoronavirus.com"; sid:513914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for alertcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"alertcovid-19.com"; sid:513915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for algeriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"algeriacoronavirus.com"; sid:513916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americacovid-19.com"; sid:513917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for americancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"americancorona.com"; sid:513918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amiacovidzombieyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amiacovidzombieyet.com"; sid:513919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amigoingtodiefromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amigoingtodiefromcoronavirus.com"; sid:513920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for am-i-infected-with-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"am-i-infected-with-corona.com"; sid:513921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for amiinfectedwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"amiinfectedwithcorona.com"; sid:513922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for angolacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"angolacoronavirus.com"; sid:513923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antcorona.com"; sid:513924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antcovid19.com"; sid:513925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaconsulting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaconsulting.com"; sid:513926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamed.com"; sid:513927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronamedorg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronamedorg.com"; sid:513928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronanet.com"; sid:513929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-coronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-coronaviruses.com"; sid:513930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirusfacemasks.com"; sid:513931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruskits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruskits.com"; sid:513932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirus-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirus-masks.com"; sid:513933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruspackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruspackage.com"; sid:513934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronaviruspackages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronaviruspackages.com"; sid:513935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticoronavirussell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticoronavirussell.com"; sid:513936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anti-covid19.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anti-covid19.net"; sid:513937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for anticovidarmor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"anticovidarmor.com"; sid:513938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for antiepidemicer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"antiepidemicer.com"; sid:513939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arabiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arabiacoronavirus.com"; sid:513940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arbidolcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arbidolcoronavirus.com"; sid:513941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arcoronavirus.com"; sid:513942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for argentinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"argentinacoronavirus.com"; sid:513943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronavirus.com"; sid:513944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arizonacoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arizonacoronaviruslawyer.com"; sid:513945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arkansascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arkansascoronavirus.com"; sid:513946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for arlingtoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"arlingtoncoronavirus.com"; sid:513947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronatest.com"; sid:513948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for athomecoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"athomecoronavirustest.com"; sid:513949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for attorneyforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"attorneyforcoronavirus.com"; sid:513950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for australiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"australiacoronavirus.com"; sid:513951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for austriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"austriacoronavirus.com"; sid:513952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avellinocoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avellinocoronatest.com"; sid:513953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for aviationcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"aviationcoronavirus.com"; sid:513954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronaviruscontagion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronaviruscontagion.com"; sid:513955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoidcoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoidcoronavirus.net"; sid:513956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for avoid-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"avoid-covid19.com"; sid:513957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcoronavirus.com"; sid:513958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azcovid19.com"; sid:513959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for azerbaijancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"azerbaijancoronavirus.com"; sid:513960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for b4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"b4coronavirus.com"; sid:513961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for baltimorecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"baltimorecoronavirus.com"; sid:513962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bangladeshcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bangladeshcoronavirus.com"; sid:513963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for battlecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"battlecorona.com"; sid:513964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bbqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bbqcoronavirus.com"; sid:513965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beardsagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beardsagainstcoronavirus.com"; sid:513966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcorona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcorona.biz"; sid:513967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beat-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beat-corona.com"; sid:513968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beatcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beatcovid19.com"; sid:513969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for becovidready.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"becovidready.com"; sid:513970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beforecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beforecoronavirus.com"; sid:513971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belaruscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belaruscoronavirus.com"; sid:513972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for belgiumcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"belgiumcoronavirus.com"; sid:513973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for benincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"benincoronavirus.com"; sid:513974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bepreparedforcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bepreparedforcoronaviruses.com"; sid:513975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beready4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beready4covid19.com"; sid:513976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for berlincoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"berlincoronavirus.com"; sid:513977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for besafefromcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"besafefromcorona.com"; sid:513978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bestcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bestcoronavirus.com"; sid:513979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for beyondcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"beyondcorona.com"; sid:513980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biocleancorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biocleancorona.com"; sid:513981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for biohackingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"biohackingcoronavirus.com"; sid:513982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for blogfeedbackcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"blogfeedbackcoronavirus.com"; sid:513983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boliviacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boliviacoronavirus.com"; sid:513984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for boostimmunesystemforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"boostimmunesystemforcoronavirus.com"; sid:513985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bostoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bostoncoronavirus.com"; sid:513986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brazilcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brazilcoronavirus.com"; sid:513987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakcorona.com"; sid:513988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for breakingcoronavirusnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"breakingcoronavirusnews.com"; sid:513989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for brooklyncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"brooklyncoronavirus.com"; sid:513990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bulgariacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bulgariacoronavirus.com"; sid:513991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bumpcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bumpcovid.com"; sid:513992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burkinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burkinacoronavirus.com"; sid:513993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for burundicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"burundicoronavirus.com"; sid:513994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for bustcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"bustcovid19.com"; sid:513995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buyanticovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buyanticovid.com"; sid:513996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronavirusfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronavirusfacemask.com"; sid:513997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycoronaviruspills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycoronaviruspills.com"; sid:513998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for buycovid19testkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"buycovid19testkit.com"; sid:513999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cacoronavirus.com"; sid:514000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacorona.com"; sid:514001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for californiacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"californiacovid-19.com"; sid:514002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cambodiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cambodiacoronavirus.com"; sid:514003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for camerooncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"camerooncoronavirus.com"; sid:514004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for campcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"campcorona.com"; sid:514005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcorona.com"; sid:514006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcoronavirus.com"; sid:514007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovid19.com"; sid:514008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelcovid.com"; sid:514009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cancelledbycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cancelledbycorona.com"; sid:514010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for careforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"careforcoronavirus.com"; sid:514011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cashcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cashcorona.com"; sid:514012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cbdkillscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cbdkillscoronavirus.com"; sid:514013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovid19.com"; sid:514014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ccovid.com"; sid:514015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccheckforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccheckforcorona.com"; sid:514016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cdccovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cdccovid19.com"; sid:514017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcoronacontrol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcoronacontrol.com"; sid:514018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforcoronavirus.com"; sid:514019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for centerforpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"centerforpandemics.com"; sid:514020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirusfree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirusfree.com"; sid:514021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcoronavirusmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcoronavirusmasks.com"; sid:514022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for certifiedcovid19safedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"certifiedcovid19safedelivery.com"; sid:514023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chadcoronavirus.com"; sid:514024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for check4corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"check4corona.com"; sid:514025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkcovid.com"; sid:514026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcoronacdc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcoronacdc.com"; sid:514027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for checkforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"checkforcorona.com"; sid:514028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chicagocoronaviruslawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chicagocoronaviruslawyer.com"; sid:514029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chilecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chilecoronavirus.com"; sid:514030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for chinesecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"chinesecorona.com"; sid:514031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clevelandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clevelandcoronavirus.com"; sid:514032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for closingthedoortocorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"closingthedoortocorona.com"; sid:514033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for clubcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"clubcovid19.com"; sid:514034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cnnbreakingcovid19illinois.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cnnbreakingcovid19illinois.com"; sid:514035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cocoronavirus.com"; sid:514036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colloidalsilvercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colloidalsilvercoronavirus.com"; sid:514037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for colombiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"colombiacoronavirus.com"; sid:514038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for columbuscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"columbuscoronavirus.com"; sid:514039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatcoronaviruses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatcoronaviruses.com"; sid:514040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for combatingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"combatingcorona.com"; sid:514041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecoronavirus.com"; sid:514042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for completecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"completecovid.com"; sid:514043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for congocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"congocoronavirus.com"; sid:514044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for connecticutcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"connecticutcoronavirus.com"; sid:514045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for consejoscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"consejoscoronavirus.com"; sid:514046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for containcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"containcorona.com"; sid:514047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for controlcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"controlcorona.com"; sid:514048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cookingincovidtimes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cookingincovidtimes.com"; sid:514049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcorona.com"; sid:514050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for copingwithcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"copingwithcovid.com"; sid:514051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona1004.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona1004.com"; sid:514052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19comedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19comedy.com"; sid:514053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona19now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona19now.com"; sid:514054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-2019.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-2019.com"; sid:514055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020mask.com"; sid:514056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020masks.com"; sid:514057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2020survivor.com"; sid:514058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona247.com"; sid:514059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona2go.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona2go.com"; sid:514060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona911virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona911virus.com"; sid:514061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaactivity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaactivity.com"; sid:514062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaadvicegivers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaadvicegivers.com"; sid:514063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaambulance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaambulance.com"; sid:514064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaamerica.com"; sid:514065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibacterium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibacterium.com"; sid:514066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantibodies.com"; sid:514067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanti.com"; sid:514068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantigen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantigen.com"; sid:514069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-antivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-antivirus.com"; sid:514070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaantiviruz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaantiviruz.com"; sid:514071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaanxiety.com"; sid:514072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaapparel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaapparel.com"; sid:514073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaassistance.com"; sid:514074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaathometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaathometest.com"; sid:514075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaaware.com"; sid:514076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaawareness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaawareness.com"; sid:514077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronababyboom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronababyboom.com"; sid:514078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabalona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabalona.com"; sid:514079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabankrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabankrx.com"; sid:514080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabans.com"; sid:514081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabat.com"; sid:514082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeerrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeerrx.com"; sid:514083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabeers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabeers.com"; sid:514084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabegone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabegone.com"; sid:514085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabest.com"; sid:514086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabgone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabgone.com"; sid:514087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabharat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabharat.com"; sid:514088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabias.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabias.com"; sid:514089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabingo.com"; sid:514090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronablocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronablocks.com"; sid:514091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaboodschappen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaboodschappen.com"; sid:514092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-box.com"; sid:514093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabracelet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabracelet.com"; sid:514094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabreaks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabreaks.com"; sid:514095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabrief.com"; sid:514096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabriefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabriefs.com"; sid:514097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabuffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabuffer.com"; sid:514098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-business.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-business.com"; sid:514099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-busters.com"; sid:514100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabutiken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabutiken.com"; sid:514101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronabutton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronabutton.com"; sid:514102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacaddy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacaddy.com"; sid:514103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanada.com"; sid:514104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacanceled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacanceled.com"; sid:514105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacancellations.com"; sid:514106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacannon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacannon.com"; sid:514107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacapitalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacapitalism.com"; sid:514108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacarepacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacarepacks.com"; sid:514109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacashrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacashrx.com"; sid:514110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacentre.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacentre.com"; sid:514111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacertificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacertificate.com"; sid:514112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachans.com"; sid:514113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacharts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacharts.com"; sid:514114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckpoint.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckpoint.com"; sid:514115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacheckr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacheckr.com"; sid:514116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronachronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronachronicles.com"; sid:514117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacircle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacircle.com"; sid:514118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclause.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclause.com"; sid:514119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanco.com"; sid:514120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanest.com"; sid:514121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanhub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanhub.com"; sid:514122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningcompany.com"; sid:514123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningnyc.com"; sid:514124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleaningsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleaningsupplies.com"; sid:514125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleannow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleannow.com"; sid:514126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleans.com"; sid:514127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanser.com"; sid:514128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupbayarea.com"; sid:514129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanupca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanupca.com"; sid:514130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacleanusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacleanusa.com"; sid:514131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacles.com"; sid:514132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacliffnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacliffnotes.com"; sid:514133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacloset.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacloset.com"; sid:514134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubdj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubdj.com"; sid:514135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaclubs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaclubs.com"; sid:514136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoach.com"; sid:514137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoalition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoalition.com"; sid:514138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocktail.com"; sid:514139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacocktails.com"; sid:514140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacold.com"; sid:514141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacomedy.com"; sid:514142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompanion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompanion.com"; sid:514143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacompensation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacompensation.com"; sid:514144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacon2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacon2020.com"; sid:514145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconcierge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconcierge.com"; sid:514146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-con.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-con.com"; sid:514147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondom.com"; sid:514148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacondoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacondoms.com"; sid:514149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacones.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacones.com"; sid:514150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaconf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaconf.com"; sid:514151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontain.com"; sid:514152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacontained.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacontained.com"; sid:514153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoronaleavemealona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoronaleavemealona.com"; sid:514154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacoronaleavemealone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacoronaleavemealone.com"; sid:514155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacorrection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacorrection.com"; sid:514156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacost.com"; sid:514157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacostume.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacostume.com"; sid:514158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacostumes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacostumes.com"; sid:514159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountdown.com"; sid:514160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountriesrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountriesrx.com"; sid:514161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacountryrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacountryrx.com"; sid:514162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacounts.com"; sid:514163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19mutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19mutation.com"; sid:514164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19pump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19pump.com"; sid:514165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-covid19screen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-covid19screen.com"; sid:514166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19sex.com"; sid:514167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacovid19shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacovid19shield.com"; sid:514168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazed.com"; sid:514169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazies.com"; sid:514170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrazy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrazy.com"; sid:514171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacremation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacremation.com"; sid:514172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrisisbigbrainstorm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrisisbigbrainstorm.com"; sid:514173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacruiseship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacruiseship.com"; sid:514174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacrusade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacrusade.com"; sid:514175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuba.com"; sid:514176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacumming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacumming.com"; sid:514177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacunts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacunts.com"; sid:514178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurb.com"; sid:514179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureco.com"; sid:514180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurehub.com"; sid:514181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurenyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurenyc.com"; sid:514182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuretherapy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuretherapy.com"; sid:514183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacuretoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacuretoday.com"; sid:514184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacureusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacureusa.com"; sid:514185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronacurrency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronacurrency.com"; sid:514186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadb.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadb.net"; sid:514187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeathtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeathtracker.com"; sid:514188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadecontamination.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadecontamination.com"; sid:514189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-defenders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-defenders.com"; sid:514190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeliver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeliver.com"; sid:514191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesk.com"; sid:514192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadesktop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadesktop.com"; sid:514193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadetails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadetails.com"; sid:514194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-detector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-detector.com"; sid:514195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadeutschland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadeutschland.com"; sid:514196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadevil.com"; sid:514197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnose.com"; sid:514198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiagnosis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiagnosis.com"; sid:514199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiary.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiary.net"; sid:514200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-diet.com"; sid:514201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadiets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadiets.com"; sid:514202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisease-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisease-free.com"; sid:514203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadisinfect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadisinfect.com"; sid:514204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadjvictoria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadjvictoria.com"; sid:514205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadkillerpro.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadkillerpro.com"; sid:514206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronado-pacific.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronado-pacific.com"; sid:514207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopacificcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopacificcompany.com"; sid:514208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopacificusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopacificusa.com"; sid:514209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopreservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopreservation.com"; sid:514210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadopreservationsociety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadopreservationsociety.com"; sid:514211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadorent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadorent.com"; sid:514212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadrivethru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadrivethru.com"; sid:514213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadvirusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadvirusupdate.com"; sid:514214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronadx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronadx.com"; sid:514215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaed.com"; sid:514216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-effect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-effect.com"; sid:514217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaera.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaera.com"; sid:514218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaescorts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaescorts.com"; sid:514219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaevil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaevil.com"; sid:514220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeye.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeye.com"; sid:514221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaeyes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaeyes.com"; sid:514222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacecover19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacecover19.com"; sid:514223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafacts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafacts.biz"; sid:514224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafactsusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafactsusa.com"; sid:514225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafam.com"; sid:514226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-festival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-festival.com"; sid:514227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fight.com"; sid:514228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafighter.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafighter.net"; sid:514229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-fighters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-fighters.com"; sid:514230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafirefighter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafirefighter.com"; sid:514231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflew.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflew.com"; sid:514232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflightalert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflightalert.com"; sid:514233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflight.com"; sid:514234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaflights.com"; sid:514235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafluke.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafluke.com"; sid:514236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafootsie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafootsie.com"; sid:514237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforcemajeure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforcemajeure.com"; sid:514238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforces.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforces.com"; sid:514239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforecast.com"; sid:514240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaforecasts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaforecasts.com"; sid:514241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafornia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafornia.com"; sid:514242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree2020.com"; sid:514243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.biz"; sid:514244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreebuilders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreebuilders.com"; sid:514245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreecamsex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreecamsex.com"; sid:514246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafree.delivery - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafree.delivery"; sid:514247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreedelivery.com"; sid:514248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafreevirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafreevirus.com"; sid:514249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafriends.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafriends.com"; sid:514250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronafunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronafunds.com"; sid:514251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-game.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-game.com"; sid:514252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagard.com"; sid:514253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagaurd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagaurd.com"; sid:514254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagekitaihou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagekitaihou.com"; sid:514255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-germany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-germany.com"; sid:514256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagg.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagg.com"; sid:514257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaginus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaginus.com"; sid:514258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaglobalupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaglobalupdates.com"; sid:514259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagod.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagod.com"; sid:514260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagods.com"; sid:514261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagoods.com"; sid:514262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-grants.com"; sid:514263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagrants.com"; sid:514264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-guard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-guard.com"; sid:514265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguardian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguardian.com"; sid:514266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguidance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguidance.com"; sid:514267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronagurd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronagurd.com"; sid:514268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaguru.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaguru.com"; sid:514269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahalt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahalt.com"; sid:514270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-handsanitizer.com"; sid:514271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahandsanitizer.com"; sid:514272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahands.com"; sid:514273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealer.com"; sid:514274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-health.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-health.com"; sid:514275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthkit.com"; sid:514276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthremedy.com"; sid:514277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahealthsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahealthsupplies.com"; sid:514278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-heilen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-heilen.com"; sid:514279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahell.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahell.com"; sid:514280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelmet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelmet.com"; sid:514281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpers.com"; sid:514282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahelpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahelpfund.com"; sid:514283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-helpstore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-helpstore.com"; sid:514284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaherbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaherbs.com"; sid:514285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaheroes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaheroes.com"; sid:514286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahideout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahideout.com"; sid:514287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hilfe.com"; sid:514288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahiring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahiring.com"; sid:514289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahomeopathy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahomeopathy.com"; sid:514290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahosts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahosts.com"; sid:514291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hotspots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hotspots.com"; sid:514292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahotties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahotties.com"; sid:514293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-hq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-hq.com"; sid:514294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahq.com"; sid:514295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronahype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronahype.com"; sid:514296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaidea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaidea.com"; sid:514297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-import.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-import.com"; sid:514298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaimport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaimport.com"; sid:514299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-infos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-infos.com"; sid:514300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainitiative.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainitiative.com"; sid:514301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainstitutes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainstitutes.com"; sid:514302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainsurancegrouppr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainsurancegrouppr.com"; sid:514303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronainus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronainus.com"; sid:514304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaisfahan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaisfahan.com"; sid:514305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaita24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaita24.com"; sid:514306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaita24.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaita24.net"; sid:514307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronajoe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronajoe.com"; sid:514308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakeno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakeno.com"; sid:514309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakillercom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakillercom.com"; sid:514310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-killers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-killers.com"; sid:514311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakilling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakilling.com"; sid:514312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronakoruma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronakoruma.com"; sid:514313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabco.com"; sid:514314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaboratories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaboratories.com"; sid:514315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaboratory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaboratory.com"; sid:514316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalaboratorytesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalaboratorytesting.com"; sid:514317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabstesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabstesting.com"; sid:514318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtestingco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtestingco.com"; sid:514319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalab-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalab-testing.com"; sid:514320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtesting.com"; sid:514321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabtestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabtestings.com"; sid:514322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalabusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalabusa.com"; sid:514323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-latest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-latest.com"; sid:514324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalies.com"; sid:514325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalifesaverkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalifesaverkit.com"; sid:514326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalisa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalisa.com"; sid:514327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivebd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivebd.com"; sid:514328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivechat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivechat.com"; sid:514329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivehelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivehelp.com"; sid:514330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalivestatus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalivestatus.com"; sid:514331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaliveupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaliveupdate.com"; sid:514332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalocations.com"; sid:514333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalockdowns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalockdowns.com"; sid:514334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalotteries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalotteries.com"; sid:514335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalp.com"; sid:514336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronalympics2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronalympics2020.com"; sid:514337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamagvonim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamagvonim.com"; sid:514338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaloney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaloney.com"; sid:514339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamania.com"; sid:514340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaps.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaps.net"; sid:514341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamarkets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamarkets.com"; sid:514342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamascara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamascara.com"; sid:514343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamascarillas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamascarillas.com"; sid:514344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask19.com"; sid:514345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamask360.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamask360.com"; sid:514346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskil.com"; sid:514347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskitalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskitalia.com"; sid:514348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamasknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamasknow.com"; sid:514349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-mask-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-mask-protection.com"; sid:514350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamaskstrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamaskstrade.com"; sid:514351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameals.com"; sid:514352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-med.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-med.com"; sid:514353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamemorial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamemorial.com"; sid:514354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronameters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronameters.com"; sid:514355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronametrics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronametrics.com"; sid:514356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamiyim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamiyim.com"; sid:514357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamona.com"; sid:514358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamondkap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamondkap.com"; sid:514359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-monitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-monitor.com"; sid:514360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonitorworldwide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonitorworldwide.com"; sid:514361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonkey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonkey.com"; sid:514362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonster.com"; sid:514363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamonsters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamonsters.com"; sid:514364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamos.com"; sid:514365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamouth.com"; sid:514366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-movie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-movie.com"; sid:514367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamusicfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamusicfestival.com"; sid:514368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamustgo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamustgo.com"; sid:514369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronamutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronamutation.com"; sid:514370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-n95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-n95.com"; sid:514371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanalysis.com"; sid:514372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanames.com"; sid:514373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-naturalhealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-naturalhealth.com"; sid:514374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanearyou.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanearyou.com"; sid:514375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanecklace.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanecklace.com"; sid:514376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanederland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanederland.com"; sid:514377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaneverdies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaneverdies.com"; sid:514378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanews.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanews.biz"; sid:514379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewshealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewshealth.com"; sid:514380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsnow.com"; sid:514381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewsrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewsrx.com"; sid:514382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewssupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewssupport.com"; sid:514383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanewz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanewz.com"; sid:514384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanightmare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanightmare.com"; sid:514385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanime.com"; sid:514386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanose.com"; sid:514387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronantibodies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronantibodies.com"; sid:514388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronanxiety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronanxiety.com"; sid:514389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaolympics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaolympics.com"; sid:514390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaoracle.com"; sid:514391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaorhangover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaorhangover.com"; sid:514392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaornot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaornot.com"; sid:514393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaowner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaowner.com"; sid:514394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapackage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapackage.com"; sid:514395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapal.com"; sid:514396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapandemics.com"; sid:514397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-paranoia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-paranoia.com"; sid:514398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatient.com"; sid:514399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapatients.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapatients.com"; sid:514400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapcr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapcr.com"; sid:514401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapin.com"; sid:514402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaplanets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaplanets.com"; sid:514403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapledge.com"; sid:514404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecaution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecaution.com"; sid:514405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprecautions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprecautions.com"; sid:514406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-preppers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-preppers.com"; sid:514407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprescription.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprescription.com"; sid:514408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionmasks.com"; sid:514409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapreventionplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapreventionplan.com"; sid:514410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprofits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprofits.com"; sid:514411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-proof.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-proof.com"; sid:514412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaprotection.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaprotection.biz"; sid:514413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protection-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protection-kit.com"; sid:514414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-protection-mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-protection-mask.com"; sid:514415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaproxi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaproxi.com"; sid:514416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapurified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapurified.com"; sid:514417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapussy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapussy.com"; sid:514418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronapyaarhai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronapyaarhai.com"; sid:514419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquarantinekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquarantinekit.com"; sid:514420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaquickcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaquickcheck.com"; sid:514421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarapidtests.com"; sid:514422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaredemption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaredemption.com"; sid:514423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarefund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarefund.com"; sid:514424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-relief.com"; sid:514425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarepeller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarepeller.com"; sid:514426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaresistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaresistance.com"; sid:514427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronareview.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronareview.com"; sid:514428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronariskcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronariskcalculator.com"; sid:514429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaroller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaroller.com"; sid:514430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronarub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronarub.com"; sid:514431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-safe-case.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-safe-case.com"; sid:514432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyadvice.com"; sid:514433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetyproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetyproducts.com"; sid:514434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasafetytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasafetytips.com"; sid:514435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasaves.com"; sid:514436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascare.com"; sid:514437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascares.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascares.com"; sid:514438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaschumer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaschumer.com"; sid:514439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasciences.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasciences.com"; sid:514440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascope.com"; sid:514441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-screening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-screening.com"; sid:514442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronascrub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronascrub.com"; sid:514443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaseason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaseason.com"; sid:514444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasecure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasecure.com"; sid:514445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselfquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselfquarantine.com"; sid:514446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftest.com"; sid:514447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaselftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaselftestkit.com"; sid:514448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-sense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-sense.com"; sid:514449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasense.com"; sid:514450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservicesgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservicesgroup.com"; sid:514451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaservizi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaservizi.com"; sid:514452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasfahion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasfahion.com"; sid:514453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashield.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashield.life"; sid:514454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaship.com"; sid:514455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-shirts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-shirts.com"; sid:514456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashocks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashocks.com"; sid:514457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashoes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashoes.com"; sid:514458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashop24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashop24.com"; sid:514459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronashut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronashut.com"; sid:514460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasimple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasimple.com"; sid:514461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasland.com"; sid:514462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaslaves.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaslaves.com"; sid:514463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasmitte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasmitte.com"; sid:514464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasocial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasocial.com"; sid:514465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasoku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasoku.com"; sid:514466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-solution.com"; sid:514467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeak.com"; sid:514468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspecial.com"; sid:514469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspecialist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspecialist.com"; sid:514470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspeedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspeedtest.com"; sid:514471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaspraysanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaspraysanitizer.com"; sid:514472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-spread.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-spread.com"; sid:514473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasproducts.com"; sid:514474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasq.com"; sid:514475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastartups.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastartups.com"; sid:514476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-statistics.com"; sid:514477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-stats.com"; sid:514478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastest.com"; sid:514479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastockmarketcrash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastockmarketcrash.com"; sid:514480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastopfda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastopfda.com"; sid:514481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastop.pro - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastop.pro"; sid:514482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastory.com"; sid:514483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrain.com"; sid:514484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrains.com"; sid:514485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronastrippers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronastrippers.com"; sid:514486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasunnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasunnews.com"; sid:514487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplementpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplementpack.com"; sid:514488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasupplier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasupplier.com"; sid:514489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-support.com"; sid:514490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasuraksha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasuraksha.com"; sid:514491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurplus.com"; sid:514492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasurvey.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasurvey.net"; sid:514493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronasymptomen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronasymptomen.com"; sid:514494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronataisaku.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronataisaku.com"; sid:514495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatakip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatakip.com"; sid:514496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatalism.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatalism.com"; sid:514497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-taskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-taskforce.com"; sid:514498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatbay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatbay.com"; sid:514499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronateams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronateams.com"; sid:514500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatees.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatees.com"; sid:514501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatelehealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatelehealth.com"; sid:514502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestco.com"; sid:514503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestct.com"; sid:514504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tester.com"; sid:514505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-test-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-test-kits.com"; sid:514506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnj.com"; sid:514507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestnyc.com"; sid:514508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestny.com"; sid:514509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestpa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestpa.com"; sid:514510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatestusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatestusa.com"; sid:514511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronathon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronathon.com"; sid:514512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatimee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatimee.com"; sid:514513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatined.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatined.com"; sid:514514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatissues.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatissues.com"; sid:514515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatogo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatogo.com"; sid:514516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-tokusetsu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-tokusetsu.com"; sid:514517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrac.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrac.com"; sid:514518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackingcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackingcenter.com"; sid:514519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrackusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrackusa.com"; sid:514520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatrades.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatrades.com"; sid:514521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatraveldeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatraveldeals.com"; sid:514522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaturk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaturk.com"; sid:514523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronatyz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronatyz.com"; sid:514524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronauk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronauk.com"; sid:514525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaupdatetoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaupdatetoday.com"; sid:514526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-us-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-us-cases.com"; sid:514527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav19.com"; sid:514528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronav1rus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronav1rus.com"; sid:514529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacations.com"; sid:514530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacssin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacssin.com"; sid:514531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavacssins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavacssins.com"; sid:514532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavax.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavax.biz"; sid:514533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxcoin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxcoin.com"; sid:514534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavax.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavax.net"; sid:514535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavaxtoken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavaxtoken.com"; sid:514536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcheck.com"; sid:514537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavcleaner.com"; sid:514538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavector.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavector.com"; sid:514539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavert.com"; sid:514540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavida.com"; sid:514541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinos.com"; sid:514542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavinous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavinous.com"; sid:514543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviraus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviraus.com"; sid:514544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviricide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviricide.com"; sid:514545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirisnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirisnewsnow.com"; sid:514546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviris.zone - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviris.zone"; sid:514547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirium.com"; sid:514548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirium.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirium.net"; sid:514549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirucide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirucide.com"; sid:514550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviru.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviru.net"; sid:514551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus100.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus100.com"; sid:514552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus101rx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus101rx.com"; sid:514553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19blog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19blog.com"; sid:514554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19co.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19co.com"; sid:514555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus19global.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus19global.com"; sid:514556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19outbreak.com"; sid:514557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-19-protection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-19-protection.com"; sid:514558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2019news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2019news.com"; sid:514559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2020survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2020survivor.com"; sid:514560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus2021survivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus2021survivor.com"; sid:514561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus212.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus212.com"; sid:514562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus312.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus312.com"; sid:514563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus404.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus404.com"; sid:514564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus415.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus415.com"; sid:514565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus502.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus502.com"; sid:514566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-911.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-911.com"; sid:514567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusabq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusabq.com"; sid:514568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusact.com"; sid:514569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvisors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvisors.com"; sid:514570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvocate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvocate.com"; sid:514571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusadvocates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusadvocates.com"; sid:514572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaf.com"; sid:514573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusafghanistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusafghanistan.com"; sid:514574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagency.com"; sid:514575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagent.com"; sid:514576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusagents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusagents.com"; sid:514577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairfilter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairfilter.com"; sid:514578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairfiltration.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairfiltration.com"; sid:514579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusairport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusairport.com"; sid:514580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusak.com"; sid:514581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalabama.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalabama.com"; sid:514582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusalbuquerque.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusalbuquerque.com"; sid:514583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusal.com"; sid:514584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusall.com"; sid:514585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusamalficoast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusamalficoast.com"; sid:514586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusambulance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusambulance.com"; sid:514587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanalyst.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanalyst.com"; sid:514588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusangola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusangola.com"; sid:514589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanitizer.com"; sid:514590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanswer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanswer.com"; sid:514591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusanxietytips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusanxietytips.com"; sid:514592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarabia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarabia.com"; sid:514593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusar.com"; sid:514594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarena.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarena.com"; sid:514595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarkansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarkansas.com"; sid:514596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarlington.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarlington.com"; sid:514597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusarticles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusarticles.com"; sid:514598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistance.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistance.club"; sid:514599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassistance.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassistance.net"; sid:514600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusassociates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusassociates.com"; sid:514601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlanta.com"; sid:514602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusatlantaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusatlantaga.com"; sid:514603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-attorney.com"; sid:514604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauction.com"; sid:514605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaudiobook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaudiobook.com"; sid:514606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaudiobooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaudiobooks.com"; sid:514607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaudio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaudio.com"; sid:514608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaustria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaustria.com"; sid:514609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusauthority.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusauthority.com"; sid:514610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusawards.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusawards.com"; sid:514611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusaway.com"; sid:514612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusazerbaijan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusazerbaijan.com"; sid:514613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusball.com"; sid:514614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusballs.com"; sid:514615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbaltimore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbaltimore.com"; sid:514616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusband.com"; sid:514617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbangladesh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbangladesh.com"; sid:514618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbank.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbank.com"; sid:514619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbanking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbanking.com"; sid:514620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbargain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbargain.com"; sid:514621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbargains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbargains.com"; sid:514622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbayarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbayarea.com"; sid:514623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeijing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeijing.com"; sid:514624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbelarus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbelarus.com"; sid:514625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbelgium.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbelgium.com"; sid:514626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbend.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbend.com"; sid:514627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbenefit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbenefit.com"; sid:514628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbenin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbenin.com"; sid:514629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeprepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeprepared.com"; sid:514630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-berlin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-berlin.com"; sid:514631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusberniesanders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusberniesanders.com"; sid:514632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbestfacemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbestfacemask.com"; sid:514633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbets.com"; sid:514634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeverlyhills.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeverlyhills.com"; sid:514635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbeware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbeware.com"; sid:514636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiden.com"; sid:514637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbingo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbingo.com"; sid:514638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbiohazard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbiohazard.com"; sid:514639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbitches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbitches.com"; sid:514640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblockage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblockage.com"; sid:514641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblogger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblogger.com"; sid:514642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbloodtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbloodtests.com"; sid:514643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusblurb.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusblurb.com"; sid:514644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusboat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusboat.com"; sid:514645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbob.com"; sid:514646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbolivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbolivia.com"; sid:514647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbonds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbonds.com"; sid:514648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbooks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbooks.com"; sid:514649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbracelets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbracelets.com"; sid:514650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrands.com"; sid:514651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbreakouts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbreakouts.com"; sid:514652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbriefs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbriefs.com"; sid:514653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbronx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbronx.com"; sid:514654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbrooklyn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbrooklyn.com"; sid:514655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbs.com"; sid:514656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbubble.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbubble.com"; sid:514657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbugoutbag.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbugoutbag.com"; sid:514658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbuilders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbuilders.com"; sid:514659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbulgaria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbulgaria.com"; sid:514660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbunker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbunker.com"; sid:514661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusburkina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusburkina.com"; sid:514662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusburundi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusburundi.com"; sid:514663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessconsultants.com"; sid:514664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinesscredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinesscredit.com"; sid:514665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessfunding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessfunding.com"; sid:514666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbusinessinterruptioninsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbusinessinterruptioninsurance.com"; sid:514667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-busters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-busters.com"; sid:514668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusbystate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusbystate.com"; sid:514669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-ca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-ca.com"; sid:514670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusca.com"; sid:514671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cal.com"; sid:514672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscal.com"; sid:514673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalgary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalgary.com"; sid:514674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscali.com"; sid:514675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscalif.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscalif.com"; sid:514676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-california.com"; sid:514677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscall.com"; sid:514678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscambodia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscambodia.com"; sid:514679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscameroon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscameroon.com"; sid:514680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscampaign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscampaign.com"; sid:514681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscampus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscampus.com"; sid:514682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscancellations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscancellations.com"; sid:514683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapital.com"; sid:514684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscapitol.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscapitol.com"; sid:514685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareer.com"; sid:514686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareers.com"; sid:514687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscarekit.com"; sid:514688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscareservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscareservices.com"; sid:514689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscash.com"; sid:514690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscast.com"; sid:514691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscatcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscatcare.com"; sid:514692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscat.com"; sid:514693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertification.com"; sid:514694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscertified.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscertified.com"; sid:514695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschad.com"; sid:514696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschaina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschaina.com"; sid:514697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscharlotte.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscharlotte.com"; sid:514698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.cheap - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.cheap"; sid:514699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschef.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschef.com"; sid:514700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschildren.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschildren.com"; sid:514701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruschronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruschronicles.com"; sid:514702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscide.com"; sid:514703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscincinnati.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscincinnati.com"; sid:514704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscincy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscincy.com"; sid:514705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscity.com"; sid:514706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-claims.com"; sid:514707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimsus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimsus.com"; sid:514708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclaimus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclaimus.com"; sid:514709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclarksville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclarksville.com"; sid:514710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclass.com"; sid:514711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclasses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclasses.com"; sid:514712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanerservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanerservices.com"; sid:514713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningcompany.com"; sid:514714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningprocedures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningprocedures.com"; sid:514715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsanfrancisco.com"; sid:514716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanings.com"; sid:514717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservicessanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservicessanfrancisco.com"; sid:514718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningservicessf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningservicessf.com"; sid:514719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleaningsf.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleaningsf.com"; sid:514720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanser.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanser.com"; sid:514721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanservices.com"; sid:514722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupcrews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupcrews.com"; sid:514723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleanupga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleanupga.com"; sid:514724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclear.com"; sid:514725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscleveland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscleveland.com"; sid:514726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclick.com"; sid:514727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscliffnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscliffnotes.com"; sid:514728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclinton.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclinton.com"; sid:514729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclock.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclock.com"; sid:514730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosings.com"; sid:514731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclosures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclosures.com"; sid:514732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclothing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclothing.com"; sid:514733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusclub.com"; sid:514734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoaches.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoaches.com"; sid:514735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoaching.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoaching.com"; sid:514736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscocktail.com"; sid:514737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscocktails.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscocktails.com"; sid:514738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscollapse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscollapse.com"; sid:514739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscolorado.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscolorado.com"; sid:514740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscolumbus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscolumbus.com"; sid:514741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscombat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscombat.com"; sid:514742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscom.com"; sid:514743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedy.com"; sid:514744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscomedyfactory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscomedyfactory.com"; sid:514745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscommunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscommunity.com"; sid:514746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconference.com"; sid:514747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconfirmed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconfirmed.com"; sid:514748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscongo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscongo.com"; sid:514749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconnecticut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconnecticut.com"; sid:514750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusconsultants.com"; sid:514751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-consultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-consultants.com"; sid:514752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusconsultants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusconsultants.com"; sid:514753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscook.com"; sid:514754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscostarica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscostarica.com"; sid:514755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscost.com"; sid:514756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscotedivoire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscotedivoire.com"; sid:514757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscough.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscough.com"; sid:514758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscouncil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscouncil.com"; sid:514759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounsel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounsel.com"; sid:514760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscounseling.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscounseling.com"; sid:514761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscouple.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscouple.com"; sid:514762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoupon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoupon.com"; sid:514763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscoupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscoupons.com"; sid:514764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscourse.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscourse.com"; sid:514765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscourses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscourses.com"; sid:514766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscov19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscov19.com"; sid:514767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscover.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscover.com"; sid:514768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid-19-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid-19-dashboard.com"; sid:514769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-france.com"; sid:514770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-covid19-n95mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-covid19-n95mask.com"; sid:514771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid19preparedness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid19preparedness.com"; sid:514772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscovid-19update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscovid-19update.com"; sid:514773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscrafts.com"; sid:514774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscredit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscredit.com"; sid:514775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseinsurance.com"; sid:514776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiselawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiselawsuit.com"; sid:514777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruisesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruisesafety.com"; sid:514778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruises.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruises.com"; sid:514779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscruiseship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscruiseship.com"; sid:514780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuba.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuba.com"; sid:514781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-cure.com"; sid:514782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscuree.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscuree.com"; sid:514783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscurekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscurekit.com"; sid:514784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-cures.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-cures.com"; sid:514785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscustommask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscustommask.com"; sid:514786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruscyprus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruscyprus.com"; sid:514787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusczech.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusczech.com"; sid:514788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-daily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-daily.com"; sid:514789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdailyupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdailyupdate.com"; sid:514790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdallas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdallas.com"; sid:514791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdamages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdamages.com"; sid:514792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dashboard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dashboard.com"; sid:514793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdash.com"; sid:514794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatabase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatabase.com"; sid:514795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdatanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdatanow.com"; sid:514796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdataonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdataonline.com"; sid:514797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdead.com"; sid:514798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeadpool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeadpool.com"; sid:514799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdeathcalculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdeathcalculator.com"; sid:514800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebate.com"; sid:514801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdebt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdebt.com"; sid:514802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenseca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenseca.com"; sid:514803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefensekits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefensekits.com"; sid:514804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefenses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefenses.com"; sid:514805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdefinition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdefinition.com"; sid:514806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdelaware.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdelaware.com"; sid:514807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdenver.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdenver.com"; sid:514808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdepression.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdepression.com"; sid:514809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdetroit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdetroit.com"; sid:514810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiary.com"; sid:514811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.digital - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.digital"; sid:514812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscount.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscount.com"; sid:514813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscounts.com"; sid:514814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscovery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscovery.com"; sid:514815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiscuss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiscuss.com"; sid:514816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasecovid-19.com"; sid:514817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseaseoutbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseaseoutbreak.com"; sid:514818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdiseasesymptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdiseasesymptoms.com"; sid:514819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-disinfectant.com"; sid:514820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisney.com"; sid:514821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisneyinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisneyinsurance.com"; sid:514822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisneysafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisneysafety.com"; sid:514823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisputes.com"; sid:514824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdisruption.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdisruption.com"; sid:514825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-dkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-dkit.com"; sid:514826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdkits.com"; sid:514827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocblog.com"; sid:514828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocsct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocsct.com"; sid:514829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdocumentary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdocumentary.com"; sid:514830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogcare.com"; sid:514831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdog.com"; sid:514832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdogs.com"; sid:514833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomain.com"; sid:514834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdomainnames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdomainnames.com"; sid:514835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdominican.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdominican.com"; sid:514836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusdownload.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusdownload.com"; sid:514837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusduty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusduty.com"; sid:514838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusearth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusearth.com"; sid:514839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomics.com"; sid:514840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseconomy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseconomy.com"; sid:514841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseffect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseffect.com"; sid:514842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseldercare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseldercare.com"; sid:514843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselderlycare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselderlycare.com"; sid:514844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselection.com"; sid:514845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselectric.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselectric.com"; sid:514846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruselpaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruselpaso.com"; sid:514847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemergencykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemergencykitbox.com"; sid:514848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusemploymentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusemploymentlaw.com"; sid:514849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenelperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenelperu.com"; sid:514850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.energy - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.energy"; sid:514851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenperu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenperu.com"; sid:514852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusenterprise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusenterprise.com"; sid:514853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusequipment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusequipment.com"; sid:514854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusescapeplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusescapeplan.com"; sid:514855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesrx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesrx.com"; sid:514856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesshare.com"; sid:514857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusestest.com"; sid:514858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusesupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusesupdate.com"; sid:514859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusethiopia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusethiopia.com"; sid:514860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusetiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusetiquette.com"; sid:514861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseugene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseugene.com"; sid:514862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruseureka.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruseureka.com"; sid:514863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevaccine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevaccine.com"; sid:514864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevent.com"; sid:514865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusevents.com"; sid:514866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexercise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexercise.com"; sid:514867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexperience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexperience.com"; sid:514868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexplosion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexplosion.com"; sid:514869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.exposed - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.exposed"; sid:514870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusexposure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusexposure.com"; sid:514871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamily.com"; sid:514872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilykit.com"; sid:514873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfamilykits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfamilykits.com"; sid:514874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfaso.com"; sid:514875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfestival.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfestival.com"; sid:514876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfiction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfiction.com"; sid:514877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfighterca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfighterca.com"; sid:514878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilm.com"; sid:514879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfilms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfilms.com"; sid:514880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinance.com"; sid:514881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfinland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfinland.com"; sid:514882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaid.com"; sid:514883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaidkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaidkit.com"; sid:514884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfirstaidkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfirstaidkits.com"; sid:514885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfitness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfitness.com"; sid:514886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusflash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusflash.com"; sid:514887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-florida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-florida.com"; sid:514888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfocus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfocus.com"; sid:514889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfood.com"; sid:514890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforbusinesses.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforbusinesses.com"; sid:514891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfordummies.com"; sid:514892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforecast.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforecast.com"; sid:514893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusforemployers.com"; sid:514894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortlauderdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortlauderdale.com"; sid:514895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfortworth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfortworth.com"; sid:514896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfranklin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfranklin.com"; sid:514897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfraud.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfraud.com"; sid:514898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-free.com"; sid:514899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfreedom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfreedom.com"; sid:514900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfresno.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfresno.com"; sid:514901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusfuture.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusfuture.com"; sid:514902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgames.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgames.com"; sid:514903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgasmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgasmask.com"; sid:514904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgasmasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgasmasks.com"; sid:514905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgeek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgeek.com"; sid:514906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenesis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenesis.com"; sid:514907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenie.com"; sid:514908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenius.com"; sid:514909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgenome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgenome.com"; sid:514910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgetaway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgetaway.com"; sid:514911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusghana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusghana.com"; sid:514912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgifts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgifts.com"; sid:514913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgirls.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgirls.com"; sid:514914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusglobalforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusglobalforce.com"; sid:514915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.gold - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.gold"; sid:514916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgold.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgold.com"; sid:514917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgoods.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgoods.com"; sid:514918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgovernmentfunds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgovernmentfunds.com"; sid:514919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgranada.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgranada.com"; sid:514920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-grants.com"; sid:514921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrants.com"; sid:514922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgraphs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgraphs.com"; sid:514923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgreenzone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgreenzone.com"; sid:514924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgrief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgrief.com"; sid:514925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-grippe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-grippe.com"; sid:514926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-guide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-guide.com"; sid:514927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguideonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguideonline.com"; sid:514928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguinea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguinea.com"; sid:514929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguy.com"; sid:514930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusguys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusguys.com"; sid:514931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusgym.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusgym.com"; sid:514932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushacker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushacker.com"; sid:514933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushaiti.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushaiti.com"; sid:514934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushandsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushandsoap.com"; sid:514935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthchats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthchats.com"; sid:514936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthinfo.com"; sid:514937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthline.com"; sid:514938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealthmeds.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealthmeds.com"; sid:514939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushealth.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushealth.net"; sid:514940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusheattreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusheattreatment.com"; sid:514941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpfund.com"; sid:514942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpkit.com"; sid:514943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushelpnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushelpnow.com"; sid:514944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushendersonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushendersonville.com"; sid:514945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushi.com"; sid:514946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushield.com"; sid:514947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-hilfe.com"; sid:514948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushire.com"; sid:514949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushistories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushistories.com"; sid:514950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushollywood.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushollywood.com"; sid:514951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomecare.com"; sid:514952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomesafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomesafety.com"; sid:514953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushomestest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushomestest.com"; sid:514954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestingkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestingkits.com"; sid:514955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestkits.com"; sid:514956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometestkits.net"; sid:514957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushometests.com"; sid:514958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushonduras.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushonduras.com"; sid:514959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushong.com"; sid:514960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushonolulu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushonolulu.com"; sid:514961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushope.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushope.com"; sid:514962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushospitalsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushospitalsafety.com"; sid:514963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotels.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotels.com"; sid:514964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotlinefl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotlinefl.com"; sid:514965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushotlineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushotlineusa.com"; sid:514966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushumor.com"; sid:514967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushungary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushungary.com"; sid:514968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushunter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushunter.com"; sid:514969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushurts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushurts.com"; sid:514970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushygiene.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushygiene.com"; sid:514971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirushype.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirushype.com"; sid:514972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusia.com"; sid:514973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusidaho.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusidaho.com"; sid:514974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusidiots.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusidiots.com"; sid:514975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusil.com"; sid:514976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimages.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimages.com"; sid:514977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimaging.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimaging.com"; sid:514978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunesystemboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunesystemboost.com"; sid:514979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimmunityboost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimmunityboost.com"; sid:514980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimpeachment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimpeachment.com"; sid:514981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimunity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimunity.com"; sid:514982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusimunity.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusimunity.net"; sid:514983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinatlanta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinatlanta.com"; sid:514984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusincome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusincome.com"; sid:514985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-india.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-india.com"; sid:514986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindianapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindianapolis.com"; sid:514987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindogs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindogs.com"; sid:514988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindonesia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindonesia.com"; sid:514989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusindustry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusindustry.com"; sid:514990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfectionreports.com"; sid:514991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoapp.com"; sid:514992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virusinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virusinfo.com"; sid:514993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfofl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfofl.com"; sid:514994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoforemployers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoforemployers.com"; sid:514995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfoguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfoguide.com"; sid:514996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfolive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfolive.com"; sid:514997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinfous.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinfous.com"; sid:514998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhaler.com"; sid:514999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhomecare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhomecare.com"; sid:515000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinhouston.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinhouston.com"; sid:515001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjuryclaims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjuryclaims.com"; sid:515002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjury.com"; sid:515003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinjurylawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinjurylawyers.com"; sid:515004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinnovation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinnovation.com"; sid:515005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinquest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinquest.com"; sid:515006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusins.com"; sid:515007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsights.com"; sid:515008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.institute - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.institute"; sid:515009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinsuranceagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinsuranceagency.com"; sid:515010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvasion.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvasion.com"; sid:515011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestment.com"; sid:515012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusinvestor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusinvestor.com"; sid:515013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiowa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiowa.com"; sid:515014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusiraq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusiraq.com"; sid:515015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisland.com"; sid:515016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusisrael.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusisrael.com"; sid:515017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitalia.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitalia.biz"; sid:515018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusitems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusitems.com"; sid:515019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjacksonville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjacksonville.com"; sid:515020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjob.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjob.com"; sid:515021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjobs.com"; sid:515022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusjoebiden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusjoebiden.com"; sid:515023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskansascity.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskansascity.com"; sid:515024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskansas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskansas.com"; sid:515025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskazakhstan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskazakhstan.com"; sid:515026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskentucky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskentucky.com"; sid:515027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskenya.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskenya.com"; sid:515028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskeyword.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskeyword.com"; sid:515029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskillspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskillspray.com"; sid:515030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskingcounty.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskingcounty.com"; sid:515031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskingdom.com"; sid:515032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskings.com"; sid:515033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskissmyass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskissmyass.com"; sid:515034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskitstest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskitstest.com"; sid:515035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskittest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskittest.com"; sid:515036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknowledge.com"; sid:515037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusknoxville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusknoxville.com"; sid:515038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskong.com"; sid:515039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusks.com"; sid:515040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruskudlow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruskudlow.com"; sid:515041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusky.com"; sid:515042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabchip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabchip.com"; sid:515043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lab.com"; sid:515044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslabtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslabtests.com"; sid:515045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-la.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-la.com"; sid:515046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslasvegas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslasvegas.com"; sid:515047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-latestnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-latestnews.com"; sid:515048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-law.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-law.com"; sid:515049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawfirms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawfirms.com"; sid:515050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawforbusiness.com"; sid:515051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslawgroup.com"; sid:515052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawsuits.com"; sid:515053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawsuits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawsuits.com"; sid:515054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawyer.com"; sid:515055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawyer.com"; sid:515056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-lawyers.com"; sid:515057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-lawyers.com"; sid:515058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-l.com"; sid:515059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusl.com"; sid:515060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleader.com"; sid:515061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleaders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleaders.com"; sid:515062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusleadership.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusleadership.com"; sid:515063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalassistance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalassistance.com"; sid:515064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalcenter.com"; sid:515065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalhelp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalhelp.com"; sid:515066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslegalrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslegalrights.com"; sid:515067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslibrary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslibrary.com"; sid:515068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslight.com"; sid:515069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslistingexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslistingexpert.com"; sid:515070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslite.com"; sid:515071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslivestream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslivestream.com"; sid:515072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusliving.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusliving.com"; sid:515073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusllc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusllc.com"; sid:515074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloan.com"; sid:515075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusloans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusloans.com"; sid:515076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslocationmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslocationmap.com"; sid:515077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslogistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslogistics.com"; sid:515078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslondon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslondon.com"; sid:515079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslongbeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslongbeach.com"; sid:515080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslongisland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslongisland.com"; sid:515081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslosangelesca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslosangelesca.com"; sid:515082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslottery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslottery.com"; sid:515083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruslouisville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruslouisville.com"; sid:515084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusly.com"; sid:515085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmachine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmachine.com"; sid:515086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusma.com"; sid:515087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadagascar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadagascar.com"; sid:515088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmadison.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmadison.com"; sid:515089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-magazin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-magazin.com"; sid:515090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmagazine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmagazine.com"; sid:515091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaine.com"; sid:515092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmakemoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmakemoney.com"; sid:515093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalaga.com"; sid:515094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmalawi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmalawi.com"; sid:515095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmali.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmali.com"; sid:515096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmanager.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmanager.com"; sid:515097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmanhattan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmanhattan.com"; sid:515098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmania.com"; sid:515099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-manual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-manual.com"; sid:515100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-manuel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-manuel.com"; sid:515101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mapping.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mapping.com"; sid:515102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarbella.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarbella.com"; sid:515103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmarketing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmarketing.com"; sid:515104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskesi.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskesi.net"; sid:515105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskindia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskindia.com"; sid:515106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasknow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasknow.com"; sid:515107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmaskscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmaskscovid19.com"; sid:515108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmasksn95s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmasksn95s.com"; sid:515109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmassachusetts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmassachusetts.com"; sid:515110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmassagece.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmassagece.com"; sid:515111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmd.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmd.net"; sid:515112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeal.com"; sid:515113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedford.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedford.com"; sid:515114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedicinefamily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedicinefamily.com"; sid:515115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedkit.com"; sid:515116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmedtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmedtest.com"; sid:515117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmeeting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmeeting.com"; sid:515118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemphis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemphis.com"; sid:515119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmemphistn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmemphistn.com"; sid:515120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmenu.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmenu.com"; sid:515121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmerchant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmerchant.com"; sid:515122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmesa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmesa.com"; sid:515123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmex.com"; sid:515124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-mexico.com"; sid:515125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmiamiflorida.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmiamiflorida.com"; sid:515126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmi.com"; sid:515127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmilwaukee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmilwaukee.com"; sid:515128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminneapolis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminneapolis.com"; sid:515129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusminnesota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusminnesota.com"; sid:515130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmississippi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmississippi.com"; sid:515131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmlm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmlm.com"; sid:515132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmn.com"; sid:515133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmo.com"; sid:515134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmom.com"; sid:515135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoney.com"; sid:515136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmontana.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmontana.com"; sid:515137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmortgage.com"; sid:515138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmoscow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmoscow.com"; sid:515139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmozambique.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmozambique.com"; sid:515140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmta.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmta.com"; sid:515141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmt.com"; sid:515142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmundo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmundo.com"; sid:515143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmusic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmusic.com"; sid:515144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmutation.com"; sid:515145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyanmar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyanmar.com"; sid:515146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyrtlebeach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyrtlebeach.com"; sid:515147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusmyths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusmyths.com"; sid:515148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-n95-respirator-facemask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-n95-respirator-facemask.com"; sid:515149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusname.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusname.com"; sid:515150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnashville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnashville.com"; sid:515151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnation.com"; sid:515152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnatural.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnatural.com"; sid:515153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturaldefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturaldefense.com"; sid:515154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturalsupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturalsupplements.com"; sid:515155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaturopathic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaturopathic.com"; sid:515156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnaz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnaz.com"; sid:515157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnd.com"; sid:515158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnebraska.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnebraska.com"; sid:515159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusne.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusne.com"; sid:515160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnegligence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnegligence.com"; sid:515161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnepal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnepal.com"; sid:515162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnetherlands.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnetherlands.com"; sid:515163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus.network - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus.network"; sid:515164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewhampshire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewhampshire.com"; sid:515165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewjersey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewjersey.com"; sid:515166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewmexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewmexico.com"; sid:515167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewnow.com"; sid:515168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusneworleans.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusneworleans.com"; sid:515169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews247.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews247.com"; sid:515170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnews24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnews24.com"; sid:515171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsbd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsbd.com"; sid:515172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsdaily.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsdaily.com"; sid:515173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsforbusiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsforbusiness.com"; sid:515174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewspage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewspage.com"; sid:515175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewspaper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewspaper.com"; sid:515176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsreport.com"; sid:515177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewsstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewsstories.com"; sid:515178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewswire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewswire.com"; sid:515179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newyork-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newyork-cases.com"; sid:515180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-newyork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-newyork.com"; sid:515181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnewyorkny.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnewyorkny.com"; sid:515182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnh.com"; sid:515183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusniger.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusniger.com"; sid:515184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnm.com"; sid:515185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnola.com"; sid:515186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorthcarolina.com"; sid:515187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorth.com"; sid:515188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorthdakota.com"; sid:515189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnorway.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnorway.com"; sid:515190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotes.com"; sid:515191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnotify.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnotify.com"; sid:515192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnovel.com"; sid:515193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-now.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-now.com"; sid:515194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnownews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnownews.com"; sid:515195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnus.com"; sid:515196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnutrition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnutrition.com"; sid:515197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnv.com"; sid:515198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusnw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusnw.com"; sid:515199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoakland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoakland.com"; sid:515200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoath.com"; sid:515201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruso.com"; sid:515202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffer.com"; sid:515203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffers.com"; sid:515204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoffice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoffice.com"; sid:515205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoh.com"; sid:515206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusohio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusohio.com"; sid:515207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoil.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoil.com"; sid:515208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusok.com"; sid:515209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoklahoma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoklahoma.com"; sid:515210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusolympic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusolympic.com"; sid:515211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusomaha.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusomaha.com"; sid:515212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusone.com"; sid:515213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-onlinekongress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-onlinekongress.com"; sid:515214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusopendata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusopendata.com"; sid:515215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoracle.com"; sid:515216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoslo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoslo.com"; sid:515217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusoutlet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusoutlet.com"; sid:515218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspakistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspakistan.com"; sid:515219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemiclaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemiclaw.com"; sid:515220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspandemicnews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspandemicnews.com"; sid:515221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspantry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspantry.com"; sid:515222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspapua.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspapua.com"; sid:515223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparadise.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparadise.com"; sid:515224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparaso.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparaso.com"; sid:515225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusparis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusparis.com"; sid:515226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartner.com"; sid:515227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspartners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspartners.com"; sid:515228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatient.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatient.com"; sid:515229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientmonitoring.com"; sid:515230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientobservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientobservation.com"; sid:515231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspatientzero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspatientzero.com"; sid:515232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspcp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspcp.com"; sid:515233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspcps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspcps.com"; sid:515234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspechino.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspechino.com"; sid:515235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspensacola.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspensacola.com"; sid:515236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalinjury.com"; sid:515237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspersonalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspersonalservices.com"; sid:515238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetition.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetition.com"; sid:515239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspetsafety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspetsafety.com"; sid:515240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspets.com"; sid:515241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspharmaceutical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspharmaceutical.com"; sid:515242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphilippines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphilippines.com"; sid:515243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoenix.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoenix.com"; sid:515244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphoto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphoto.com"; sid:515245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphotos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphotos.com"; sid:515246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusphx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusphx.com"; sid:515247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspilot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspilot.com"; sid:515248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.pizza - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.pizza"; sid:515249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplaintiff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplaintiff.com"; sid:515250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanet.com"; sid:515251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplanner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplanner.com"; sid:515252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplasma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplasma.com"; sid:515253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspledge.com"; sid:515254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusplus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusplus.com"; sid:515255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspoland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspoland.com"; sid:515256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspolicytemplate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspolicytemplate.com"; sid:515257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspopup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspopup.com"; sid:515258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusportfolio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusportfolio.com"; sid:515259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusportugal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusportugal.com"; sid:515260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspositive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspositive.com"; sid:515261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspost.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspost.com"; sid:515262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusposter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusposter.com"; sid:515263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspray.com"; sid:515264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprayer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprayer.com"; sid:515265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspredictions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspredictions.com"; sid:515266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-preparation.com"; sid:515267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prepared.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prepared.com"; sid:515268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprepguide.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprepguide.com"; sid:515269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreps.com"; sid:515270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspresident.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspresident.com"; sid:515271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspreventing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspreventing.com"; sid:515272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprevention101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprevention101.com"; sid:515273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prevention-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prevention-kit.com"; sid:515274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevention-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevention-kit.com"; sid:515275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-prevention-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-prevention-kits.com"; sid:515276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-prevention-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-prevention-kits.com"; sid:515277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprimary.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprimary.com"; sid:515278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproblem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproblem.com"; sid:515279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproduction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproduction.com"; sid:515280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproductions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproductions.com"; sid:515281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproduct.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproduct.net"; sid:515282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-products.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-products.com"; sid:515283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofessional.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofessional.com"; sid:515284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprofessor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprofessor.com"; sid:515285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromo.com"; sid:515286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspromotions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspromotions.com"; sid:515287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproofs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproofs.com"; sid:515288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusproperties.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusproperties.com"; sid:515289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusprotection2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusprotection2020.com"; sid:515290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-box.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-box.com"; sid:515291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-protection-kits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-protection-kits.com"; sid:515292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspurge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspurge.com"; sid:515293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspurification.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspurification.com"; sid:515294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruspuzzle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruspuzzle.com"; sid:515295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-quarantine.com"; sid:515296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquarantineworkfromhomejobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquarantineworkfromhomejobs.com"; sid:515297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusqueens.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusqueens.com"; sid:515298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-questions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-questions.com"; sid:515299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusquotes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusquotes.com"; sid:515300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusr0.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusr0.com"; sid:515301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradio.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradio.com"; sid:515302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradiologist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradiologist.com"; sid:515303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradiologists.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradiologists.com"; sid:515304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusradiology.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusradiology.com"; sid:515305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusraleigh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusraleigh.com"; sid:515306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtesting.com"; sid:515307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrapidtestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrapidtestkit.com"; sid:515308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrate.com"; sid:515309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrates.com"; sid:515310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreadykit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreadykit.com"; sid:515311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreal.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreal.com"; sid:515312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrealestateexpert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrealestateexpert.com"; sid:515313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreality.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreality.com"; sid:515314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrecipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrecipes.com"; sid:515315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreinfection.com"; sid:515316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremotepatientmonitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremotepatientmonitoring.com"; sid:515317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusremotepatientobservation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusremotepatientobservation.com"; sid:515318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreporter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreporter.com"; sid:515319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreporting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreporting.com"; sid:515320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearcher.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearcher.com"; sid:515321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresearch.fund - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresearch.fund"; sid:515322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusresourcehub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusresourcehub.com"; sid:515323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrestroomsigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrestroomsigns.com"; sid:515324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusreviews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusreviews.com"; sid:515325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrightnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrightnow.com"; sid:515326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrights.com"; sid:515327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusroma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusroma.com"; sid:515328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusromania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusromania.com"; sid:515329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrule.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrule.com"; sid:515330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrumors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrumors.com"; sid:515331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrus.com"; sid:515332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusrwanda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusrwanda.com"; sid:515333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sa.com"; sid:515334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussacramento.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussacramento.com"; sid:515335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafekit.com"; sid:515336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafespot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafespot.com"; sid:515337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyadvice.com"; sid:515338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetykitbox.com"; sid:515339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-safety-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-safety-kit.com"; sid:515340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetymanual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetymanual.com"; sid:515341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetymask.com"; sid:515342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetyservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetyservices.com"; sid:515343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetysolutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetysolutions.com"; sid:515344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafetystore.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafetystore.com"; sid:515345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussafezone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussafezone.com"; sid:515346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaga.com"; sid:515347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussale.com"; sid:515348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussalem.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussalem.com"; sid:515349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussales.com"; sid:515350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanders.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanders.com"; sid:515351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussandiego.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussandiego.com"; sid:515352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfrancisco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfrancisco.com"; sid:515353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanfran.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanfran.com"; sid:515354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanitizers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanitizers.com"; sid:515355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussanjose.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussanjose.com"; sid:515356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussantaclara.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussantaclara.com"; sid:515357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sante.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sante.com"; sid:515358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussardina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussardina.com"; sid:515359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussaudi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussaudi.com"; sid:515360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussc.com"; sid:515361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschoolclosings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschoolclosings.com"; sid:515362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusschool.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusschool.com"; sid:515363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-schweiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-schweiz.com"; sid:515364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-s.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-s.com"; sid:515365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusscottsdale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusscottsdale.com"; sid:515366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussd.com"; sid:515367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selbsttest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selbsttest.com"; sid:515368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selftest.com"; sid:515369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-selftestkit.com"; sid:515370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusselftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusselftestkit.com"; sid:515371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseminar.com"; sid:515372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseminars.com"; sid:515373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussenior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussenior.com"; sid:515374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseniors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseniors.com"; sid:515375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussentinel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussentinel.com"; sid:515376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusserbia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusserbia.com"; sid:515377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusservice.com"; sid:515378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettle.com"; sid:515379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussettlements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussettlements.com"; sid:515380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussevilla.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussevilla.com"; sid:515381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusseville.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusseville.com"; sid:515382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussex.com"; sid:515383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshare.com"; sid:515384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusship.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusship.com"; sid:515385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshopper.com"; sid:515386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusshoulditravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusshoulditravel.com"; sid:515387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussign.com"; sid:515388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussites.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussites.com"; sid:515389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusskilledcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusskilledcare.com"; sid:515390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-soigner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-soigner.com"; sid:515391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussomalia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussomalia.com"; sid:515392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sos.com"; sid:515393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussos.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussos.com"; sid:515394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthafrica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthafrica.com"; sid:515395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthamerica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthamerica.com"; sid:515396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthcarolina.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthcarolina.com"; sid:515397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouth.com"; sid:515398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouthdakota.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouthdakota.com"; sid:515399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussouvenir.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussouvenir.com"; sid:515400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspecial.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspecial.com"; sid:515401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussppraysanitinizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussppraysanitinizer.com"; sid:515402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-sprays.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-sprays.com"; sid:515403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusspringfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusspringfield.com"; sid:515404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstarter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstarter.com"; sid:515405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-state-by-state.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-state-by-state.com"; sid:515406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstay.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstay.com"; sid:515407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussterilization.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussterilization.com"; sid:515408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stock-crash.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stock-crash.com"; sid:515409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstockholm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstockholm.com"; sid:515410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-stock-meltdown.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-stock-meltdown.com"; sid:515411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstorage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstorage.com"; sid:515412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstoreca.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstoreca.com"; sid:515413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstream.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstream.com"; sid:515414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstreet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstreet.com"; sid:515415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstressball.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstressball.com"; sid:515416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstressballs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstressballs.com"; sid:515417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstrong.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstrong.com"; sid:515418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusstyle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusstyle.com"; sid:515419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussudan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussudan.com"; sid:515420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuplements.com"; sid:515421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplies.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplies.club"; sid:515422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virussupplies.com"; sid:515423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupply.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupply.club"; sid:515424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupplykitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupplykitbox.com"; sid:515425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-support.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-support.com"; sid:515426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussupportonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussupportonline.com"; sid:515427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurveys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurveys.com"; sid:515428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalbook.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalbook.com"; sid:515429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalkitbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalkitbox.com"; sid:515430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivalsupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivalsupplies.com"; sid:515431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussurvivorstory.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussurvivorstory.com"; sid:515432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussuvivor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussuvivor.com"; sid:515433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussweden.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussweden.com"; sid:515434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusswitzerland.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusswitzerland.com"; sid:515435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussxsw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussxsw.com"; sid:515436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-symptom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-symptom.com"; sid:515437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussymtoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussymtoms.com"; sid:515438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussyria.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussyria.com"; sid:515439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirussystems.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirussystems.com"; sid:515440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustablets.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustablets.com"; sid:515441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustaiwan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustaiwan.com"; sid:515442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustajikistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustajikistan.com"; sid:515443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustales.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustales.com"; sid:515444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustampa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustampa.com"; sid:515445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustanzania.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustanzania.com"; sid:515446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustax.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustax.com"; sid:515447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus.taxi - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus.taxi"; sid:515448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-t.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-t.com"; sid:515449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustees.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustees.net"; sid:515450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteledoc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteledoc.com"; sid:515451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteledoctor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteledoctor.com"; sid:515452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustennessee.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustennessee.com"; sid:515453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterminator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterminator.com"; sid:515454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusterror.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusterror.com"; sid:515455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustest101.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustest101.com"; sid:515456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestathome.com"; sid:515457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestco.com"; sid:515458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virustest.com"; sid:515459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestct.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestct.com"; sid:515460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-testing.com"; sid:515461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestingcompany.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestingcompany.com"; sid:515462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestinglab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestinglab.com"; sid:515463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestings.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestings.com"; sid:515464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-test-kit.com"; sid:515465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-test-kit.com"; sid:515466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkit.net"; sid:515467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestkits.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestkits.net"; sid:515468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestnow.com"; sid:515469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustestonline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustestonline.com"; sid:515470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-tests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-tests.com"; sid:515471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusteststrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusteststrip.com"; sid:515472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-texas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-texas.com"; sid:515473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustext.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustext.com"; sid:515474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthailand.com"; sid:515475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustheband.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustheband.com"; sid:515476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthemusical.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthemusical.com"; sid:515477; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusthenovel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusthenovel.com"; sid:515478; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusticker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusticker.com"; sid:515479; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustiktok.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustiktok.com"; sid:515480; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustime.com"; sid:515481; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustimeline.com"; sid:515482; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustip.com"; sid:515483; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustn.com"; sid:515484; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustokyo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustokyo.com"; sid:515485; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustonic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustonic.com"; sid:515486; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoolbox.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoolbox.com"; sid:515487; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoolkit.com"; sid:515488; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoronto.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoronto.com"; sid:515489; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustoys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustoys.com"; sid:515490; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrackerapp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrackerapp.com"; sid:515491; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrade.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrade.com"; sid:515492; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrader.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrader.com"; sid:515493; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrading.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrading.com"; sid:515494; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustragedies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustragedies.com"; sid:515495; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustragedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustragedy.com"; sid:515496; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveladvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveladvice.com"; sid:515497; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelagent.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelagent.com"; sid:515498; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveldiscounts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveldiscounts.com"; sid:515499; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelinsurance.com"; sid:515500; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelkits.com"; sid:515501; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelpack.com"; sid:515502; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelproducts.com"; sid:515503; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelsafe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelsafe.com"; sid:515504; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustraveltips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustraveltips.com"; sid:515505; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustravelupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustravelupdates.com"; sid:515506; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustreason.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustreason.com"; sid:515507; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrek.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrek.com"; sid:515508; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrip.com"; sid:515509; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustrivia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustrivia.com"; sid:515510; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-trump.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-trump.com"; sid:515511; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusts.com"; sid:515512; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirust-shirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirust-shirt.com"; sid:515513; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustshirts.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustshirts.net"; sid:515514; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustube.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustube.com"; sid:515515; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustucson.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustucson.com"; sid:515516; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustulsa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustulsa.com"; sid:515517; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustunisia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustunisia.com"; sid:515518; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirustutor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirustutor.com"; sid:515519; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuganda.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuganda.com"; sid:515520; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusukraine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusukraine.com"; sid:515521; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuk.support - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuk.support"; sid:515522; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunit.com"; sid:515523; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunited.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunited.com"; sid:515524; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunitedkingdom.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunitedkingdom.com"; sid:515525; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusunit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusunit.net"; sid:515526; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupdate.club - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupdate.club"; sid:515527; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-updates.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-updates.net"; sid:515528; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusupport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusupport.com"; sid:515529; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-us.com"; sid:515530; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-us-news.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-us-news.com"; sid:515531; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusut.com"; sid:515532; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusuzbekistan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusuzbekistan.com"; sid:515533; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacation.com"; sid:515534; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacationdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacationdeals.com"; sid:515535; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvacations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvacations.com"; sid:515536; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinelist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinelist.com"; sid:515537; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvaccinenews.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvaccinenews.com"; sid:515538; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-virus-vaccines.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-virus-vaccines.com"; sid:515539; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusva.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusva.com"; sid:515540; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvanderbilt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvanderbilt.com"; sid:515541; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvenezuela.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvenezuela.com"; sid:515542; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvermont.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvermont.com"; sid:515543; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvet.com"; sid:515544; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusveterinarian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusveterinarian.com"; sid:515545; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusveterinarians.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusveterinarians.com"; sid:515546; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvictim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvictim.com"; sid:515547; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvideo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvideo.com"; sid:515548; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvietnam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvietnam.com"; sid:515549; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitals.com"; sid:515550; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvitamin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvitamin.com"; sid:515551; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-vitamins.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-vitamins.com"; sid:515552; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvoice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvoice.com"; sid:515553; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvorbeugen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvorbeugen.com"; sid:515554; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvote.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvote.com"; sid:515555; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvrij.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvrij.com"; sid:515556; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusvt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusvt.com"; sid:515557; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswalkingdead.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswalkingdead.com"; sid:515558; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswashers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswashers.com"; sid:515559; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswatchdog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswatchdog.com"; sid:515560; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswave.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswave.com"; sid:515561; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusweekly.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusweekly.com"; sid:515562; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswestvirginia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswestvirginia.com"; sid:515563; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswholesale.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswholesale.com"; sid:515564; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswi.com"; sid:515565; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswipe.com"; sid:515566; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-wipes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-wipes.com"; sid:515567; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswisconsin.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswisconsin.com"; sid:515568; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswizard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswizard.com"; sid:515569; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkfromhome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkfromhome.com"; sid:515570; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworking.com"; sid:515571; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworkout.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworkout.com"; sid:515572; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-world-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-world-cases.com"; sid:515573; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldhealthwatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldhealthwatch.com"; sid:515574; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusworldupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusworldupdates.com"; sid:515575; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswriter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswriter.com"; sid:515576; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswv.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswv.com"; sid:515577; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswy.com"; sid:515578; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruswyoming.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruswyoming.com"; sid:515579; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxp.com"; sid:515580; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusxxx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusxxx.com"; sid:515581; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirusyemen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirusyemen.com"; sid:515582; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszambia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszambia.com"; sid:515583; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszicam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszicam.com"; sid:515584; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszimbabwe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszimbabwe.com"; sid:515585; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirus-zone.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirus-zone.com"; sid:515586; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviruszpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviruszpack.com"; sid:515587; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavirux.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavirux.com"; sid:515588; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavius.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavius.com"; sid:515589; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaviz.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaviz.net"; sid:515590; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavkit.com"; sid:515591; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavrij.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavrij.com"; sid:515592; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavs.com"; sid:515593; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronavurus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronavurus.com"; sid:515594; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawatch2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawatch2020.com"; sid:515595; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawipe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawipe.com"; sid:515596; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworkathome.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworkathome.com"; sid:515597; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldmonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldmonitor.com"; sid:515598; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaworldwidemonitor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaworldwidemonitor.com"; sid:515599; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronawrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronawrongfuldeath.com"; sid:515600; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronaxmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronaxmask.com"; sid:515601; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazaehler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazaehler.com"; sid:515602; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coronazapper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coronazapper.com"; sid:515603; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for corona-zombie.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"corona-zombie.com"; sid:515604; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cotedivoirecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cotedivoirecoronavirus.com"; sid:515605; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-10.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-10.com"; sid:515606; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-advice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-advice.com"; sid:515607; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19af.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19af.com"; sid:515608; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19africa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19africa.com"; sid:515609; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ak.com"; sid:515610; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19al.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19al.com"; sid:515611; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-alerts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-alerts.com"; sid:515612; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19allert.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19allert.com"; sid:515613; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19analys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19analys.com"; sid:515614; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19app.com"; sid:515615; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ar.com"; sid:515616; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19athometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19athometest.com"; sid:515617; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorney.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorney.com"; sid:515618; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19attorneys.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19attorneys.com"; sid:515619; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bjj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bjj.com"; sid:515620; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19bloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19bloodtest.com"; sid:515621; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bloodtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bloodtest.com"; sid:515622; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bs.com"; sid:515623; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19bug.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19bug.com"; sid:515624; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19businessupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19businessupdate.com"; sid:515625; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19calculator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19calculator.com"; sid:515626; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19california.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19california.com"; sid:515627; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-cases.com"; sid:515628; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19certificate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19certificate.com"; sid:515629; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19challenge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19challenge.com"; sid:515630; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claim.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claim.com"; sid:515631; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19claims.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19claims.com"; sid:515632; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19classaction.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19classaction.com"; sid:515633; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-clean.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-clean.com"; sid:515634; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaner.com"; sid:515635; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaner.com"; sid:515636; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19cleaners.com"; sid:515637; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaners.com"; sid:515638; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningservice.com"; sid:515639; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cleaningservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cleaningservices.com"; sid:515640; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clinicaltest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clinicaltest.com"; sid:515641; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19clinics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19clinics.com"; sid:515642; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19clo2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19clo2.com"; sid:515643; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cocktail.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cocktail.com"; sid:515644; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19co.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19co.com"; sid:515645; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19comedyclub.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19comedyclub.com"; sid:515646; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19compliance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19compliance.com"; sid:515647; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19concerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19concerns.com"; sid:515648; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19conference.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19conference.com"; sid:515649; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19control.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19control.com"; sid:515650; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corona.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corona.biz"; sid:515651; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-corona.com"; sid:515652; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19corona-virus.com"; sid:515653; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-coronavirus-map.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-coronavirus-map.com"; sid:515654; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus.net"; sid:515655; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirustest.com"; sid:515656; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19coronavirus.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19coronavirus.world"; sid:515657; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19cr.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19cr.com"; sid:515658; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19crowd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19crowd.com"; sid:515659; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19datanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19datanow.com"; sid:515660; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19deals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19deals.com"; sid:515661; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19death.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19death.com"; sid:515662; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19de.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19de.com"; sid:515663; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19detection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19detection.com"; sid:515664; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19detectors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19detectors.com"; sid:515665; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnostic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnostic.com"; sid:515666; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19diagnostics.com"; sid:515667; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diagnostics.com"; sid:515668; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diet.com"; sid:515669; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19directions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19directions.com"; sid:515670; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disaster.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disaster.com"; sid:515671; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19diseaseupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19diseaseupdate.com"; sid:515672; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectant.com"; sid:515673; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disinfectants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disinfectants.com"; sid:515674; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19disputes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19disputes.com"; sid:515675; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19doc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19doc.com"; sid:515676; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19dx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19dx.com"; sid:515677; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19economy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19economy.com"; sid:515678; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19emergency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19emergency.com"; sid:515679; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19employersupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19employersupdate.com"; sid:515680; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19employmentlaw.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19employmentlaw.com"; sid:515681; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19events.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19events.com"; sid:515682; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19experience.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19experience.com"; sid:515683; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19exposed.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19exposed.com"; sid:515684; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fact.com"; sid:515685; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-facts.com"; sid:515686; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-faq.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-faq.com"; sid:515687; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fear.com"; sid:515688; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19feedback.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19feedback.com"; sid:515689; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19film.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19film.com"; sid:515690; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fl.com"; sid:515691; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19folding.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19folding.com"; sid:515692; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19fordummies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19fordummies.com"; sid:515693; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19forums.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19forums.com"; sid:515694; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19france.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19france.com"; sid:515695; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ga.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ga.com"; sid:515696; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalemployment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalemployment.com"; sid:515697; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19globalemploymenttracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19globalemploymenttracker.com"; sid:515698; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-grants.com"; sid:515699; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19grants.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19grants.com"; sid:515700; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsanitizer.com"; sid:515701; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19handsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19handsoap.com"; sid:515702; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19healthcare.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19healthcare.com"; sid:515703; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-hilfe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-hilfe.com"; sid:515704; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19homeremedy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19homeremedy.com"; sid:515705; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hometest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hometest.com"; sid:515706; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometestkit.com"; sid:515707; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hometests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hometests.com"; sid:515708; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19hospital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19hospital.com"; sid:515709; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19hotlineusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19hotlineusa.com"; sid:515710; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ia.com"; sid:515711; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19id.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19id.com"; sid:515712; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19il.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19il.com"; sid:515713; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19impact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19impact.com"; sid:515714; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19in.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19in.com"; sid:515715; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19infectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19infectionreports.com"; sid:515716; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inhaler.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inhaler.com"; sid:515717; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19internationalinfectionreports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19internationalinfectionreports.com"; sid:515718; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19inusa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19inusa.com"; sid:515719; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jobs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jobs.com"; sid:515720; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19jokes.com"; sid:515721; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19jokes.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19jokes.com"; sid:515722; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ks.com"; sid:515723; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ky.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ky.com"; sid:515724; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19labs.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19labs.com"; sid:515725; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19labstrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19labstrip.com"; sid:515726; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawblog.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawblog.com"; sid:515727; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawgroup.com"; sid:515728; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawsuit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawsuit.com"; sid:515729; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19lawyer.com"; sid:515730; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-lawyer.com"; sid:515731; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyer.com"; sid:515732; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19lawyers.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19lawyers.com"; sid:515733; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19l.com"; sid:515734; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19l.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19l.com"; sid:515735; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-learning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-learning.com"; sid:515736; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19learning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19learning.com"; sid:515737; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19legalinformation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19legalinformation.com"; sid:515738; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19line.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19line.com"; sid:515739; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live.com"; sid:515740; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live-update.com"; sid:515741; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-live-updates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-live-updates.com"; sid:515742; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-losgistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-losgistics.com"; sid:515743; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ma.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ma.com"; sid:515744; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19mailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19mailer.com"; sid:515745; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19maps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19maps.com"; sid:515746; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19me.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19me.com"; sid:515747; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-medicine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-medicine.com"; sid:515748; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19medtest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19medtest.com"; sid:515749; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-merch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-merch.com"; sid:515750; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-mexico.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-mexico.com"; sid:515751; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mi.com"; sid:515752; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mn.com"; sid:515753; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mo.com"; sid:515754; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ms.com"; sid:515755; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19mutation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19mutation.com"; sid:515756; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19myths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19myths.com"; sid:515757; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nc.com"; sid:515758; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nd.com"; sid:515759; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19newswire.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19newswire.com"; sid:515760; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nh.com"; sid:515761; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19nj.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19nj.com"; sid:515762; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-no.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-no.com"; sid:515763; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-nyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-nyc.com"; sid:515764; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oh.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oh.com"; sid:515765; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19oracle.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19oracle.com"; sid:515766; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-outbreak.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-outbreak.com"; sid:515767; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19pandemia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19pandemia.com"; sid:515768; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-pandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-pandemic.com"; sid:515769; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-patient-monitoring.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-patient-monitoring.com"; sid:515770; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalassistant.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalassistant.com"; sid:515771; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19personalservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19personalservices.com"; sid:515772; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ph.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ph.com"; sid:515773; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19.photos - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19.photos"; sid:515774; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19plan.com"; sid:515775; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19porn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19porn.com"; sid:515776; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19post.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19post.com"; sid:515777; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-preparation.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-preparation.com"; sid:515778; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-prevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-prevention.com"; sid:515779; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19product.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19product.com"; sid:515780; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19productions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19productions.com"; sid:515781; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projection.com"; sid:515782; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19projections.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19projections.com"; sid:515783; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ptforum.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ptforum.com"; sid:515784; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19quarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19quarantine.com"; sid:515785; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19queen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19queen.com"; sid:515786; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19quiz.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19quiz.com"; sid:515787; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19radar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19radar.com"; sid:515788; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtests.com"; sid:515789; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapidtesttaken.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapidtesttaken.com"; sid:515790; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19rapitest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19rapitest.com"; sid:515791; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19readiness.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19readiness.com"; sid:515792; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realfacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realfacts.com"; sid:515793; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19realinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19realinfo.com"; sid:515794; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19recession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19recession.com"; sid:515795; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19recource.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19recource.com"; sid:515796; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reinfection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reinfection.com"; sid:515797; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-relief.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-relief.com"; sid:515798; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19reports.com"; sid:515799; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19reports.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19reports.com"; sid:515800; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19restroomssigns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19restroomssigns.com"; sid:515801; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ri.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ri.com"; sid:515802; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sa.com"; sid:515803; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19safe.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19safe.com"; sid:515804; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19safedelivery.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19safedelivery.com"; sid:515805; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sanitizer.com"; sid:515806; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scams.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scams.com"; sid:515807; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sc.com"; sid:515808; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19scoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19scoop.com"; sid:515809; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19scoop.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19scoop.com"; sid:515810; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19screener.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19screener.com"; sid:515811; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19search.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19search.com"; sid:515812; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftest.com"; sid:515813; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-selftestkit.com"; sid:515814; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19selftestkit.com"; sid:515815; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19selftestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19selftestkit.com"; sid:515816; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19seminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19seminar.com"; sid:515817; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19seminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19seminars.com"; sid:515818; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19settlement.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19settlement.com"; sid:515819; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sex.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sex.com"; sid:515820; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19sick.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19sick.com"; sid:515821; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19sign.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19sign.com"; sid:515822; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19soap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19soap.com"; sid:515823; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solution.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solution.com"; sid:515824; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19solutions.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19solutions.com"; sid:515825; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19springfield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19springfield.com"; sid:515826; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-statistics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-statistics.com"; sid:515827; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-stats.com"; sid:515828; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-status.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-status.com"; sid:515829; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19stopper.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19stopper.com"; sid:515830; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19storm.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19storm.com"; sid:515831; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19strains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19strains.com"; sid:515832; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19strains.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19strains.com"; sid:515833; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19supportgroup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19supportgroup.com"; sid:515834; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survey.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survey.com"; sid:515835; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalkit.com"; sid:515836; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalpack.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalpack.com"; sid:515837; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19survivalpacks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19survivalpacks.com"; sid:515838; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19survive.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19survive.com"; sid:515839; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-symptoms.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-symptoms.com"; sid:515840; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19takip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19takip.com"; sid:515841; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19team.com"; sid:515842; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-test.center - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-test.center"; sid:515843; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19testcenters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19testcenters.com"; sid:515844; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tester.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tester.com"; sid:515845; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testerkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testerkit.com"; sid:515846; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-testing.com"; sid:515847; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-testing.com"; sid:515848; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-test-kit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-test-kit.com"; sid:515849; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testkit.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testkit.net"; sid:515850; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testlab.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testlab.com"; sid:515851; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19teststrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19teststrip.com"; sid:515852; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19testsupply.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19testsupply.com"; sid:515853; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19thai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19thai.com"; sid:515854; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tip.com"; sid:515855; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19tips.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19tips.com"; sid:515856; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tn.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tn.com"; sid:515857; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19toolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19toolkit.com"; sid:515858; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracker.com"; sid:515859; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-tracking.com"; sid:515860; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19tracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19tracking.com"; sid:515861; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19training.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19training.net"; sid:515862; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travel.com"; sid:515863; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelinfo.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelinfo.com"; sid:515864; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19travelupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19travelupdates.com"; sid:515865; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19truths.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19truths.com"; sid:515866; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19uk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19uk.com"; sid:515867; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19untoldstories.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19untoldstories.com"; sid:515868; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19usatracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19usatracker.com"; sid:515869; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us.com"; sid:515870; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ustracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ustracker.com"; sid:515871; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-us-update.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-us-update.com"; sid:515872; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19ut.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19ut.com"; sid:515873; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19v2.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19v2.com"; sid:515874; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vaccaine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vaccaine.com"; sid:515875; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19vacine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19vacine.com"; sid:515876; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19va.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19va.com"; sid:515877; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19v.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19v.com"; sid:515878; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19view.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19view.com"; sid:515879; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19viruskiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19viruskiller.com"; sid:515880; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusprotection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusprotection.com"; sid:515881; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virussupplies.com"; sid:515882; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virussupplies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virussupplies.com"; sid:515883; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virustest.com"; sid:515884; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19virusupdate.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19virusupdate.com"; sid:515885; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19virusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19virusupdates.com"; sid:515886; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19vt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19vt.com"; sid:515887; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wa.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wa.com"; sid:515888; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19warrior.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19warrior.com"; sid:515889; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19watch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19watch.com"; sid:515890; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19whistleblower.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19whistleblower.com"; sid:515891; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19who.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19who.com"; sid:515892; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wi.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wi.com"; sid:515893; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19workplacematters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19workplacematters.com"; sid:515894; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-world-cases.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-world-cases.com"; sid:515895; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19wrongfuldeath.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19wrongfuldeath.com"; sid:515896; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-19-wuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-19-wuhan.com"; sid:515897; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19-x.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19-x.com"; sid:515898; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid19zombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid19zombies.com"; sid:515899; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid29.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid29.com"; sid:515900; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid420.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid420.com"; sid:515901; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid9app.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid9app.com"; sid:515902; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidaffectedmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidaffectedmap.com"; sid:515903; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidagency.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidagency.com"; sid:515904; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidamask.com"; sid:515905; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalysis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalysis.com"; sid:515906; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalytica.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalytica.com"; sid:515907; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidanalytics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidanalytics.com"; sid:515908; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidan.com"; sid:515909; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidantivirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidantivirus.com"; sid:515910; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidas.com"; sid:515911; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbarrier.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbarrier.com"; sid:515912; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbet.com"; sid:515913; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbot.com"; sid:515914; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidbusters.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidbusters.com"; sid:515915; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcall.com"; sid:515916; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcankissmyass.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcankissmyass.com"; sid:515917; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcaregel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcaregel.com"; sid:515918; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcarekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcarekit.com"; sid:515919; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcase.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcase.com"; sid:515920; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcenter.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcenter.com"; sid:515921; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchain.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchain.com"; sid:515922; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.chat - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.chat"; sid:515923; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-check.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-check.com"; sid:515924; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcheckup.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcheckup.com"; sid:515925; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidchronicles.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidchronicles.com"; sid:515926; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaner.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaner.com"; sid:515927; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaners.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaners.com"; sid:515928; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcleaning.com"; sid:515929; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcoach.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcoach.com"; sid:515930; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconcerns.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconcerns.com"; sid:515931; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsult.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsult.com"; sid:515932; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidconsults.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidconsults.com"; sid:515933; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcorp.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcorp.com"; sid:515934; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-cov-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-cov-19.com"; sid:515935; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcov19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcov19.com"; sid:515936; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcowork.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcowork.com"; sid:515937; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcrafts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcrafts.com"; sid:515938; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidcurekit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidcurekit.com"; sid:515939; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddating.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddating.com"; sid:515940; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddestroyer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddestroyer.com"; sid:515941; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddetection.com"; sid:515942; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddiaries.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddiaries.com"; sid:515943; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid.direct - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid.direct"; sid:515944; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddled.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddled.com"; sid:515945; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for coviddx.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"coviddx.com"; sid:515946; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidefense.com"; sid:515947; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covideo19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covideo19.com"; sid:515948; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidetection.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidetection.com"; sid:515949; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevents.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevents.com"; sid:515950; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-evidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-evidence.com"; sid:515951; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidevidence.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidevidence.com"; sid:515952; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-facemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-facemasks.com"; sid:515953; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfaceshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfaceshield.com"; sid:515954; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfacts.biz - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfacts.biz"; sid:515955; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-facts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-facts.com"; sid:515956; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfear.com"; sid:515957; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-free.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-free.com"; sid:515958; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidfund.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidfund.com"; sid:515959; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidguardian.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidguardian.com"; sid:515960; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhelmet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhelmet.com"; sid:515961; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidhero.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidhero.com"; sid:515962; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidid.com"; sid:515963; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinjury.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinjury.com"; sid:515964; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidinsurance.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidinsurance.com"; sid:515965; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabchip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabchip.com"; sid:515966; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabonachip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabonachip.com"; sid:515967; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabsprevention.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabsprevention.com"; sid:515968; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlabstrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlabstrip.com"; sid:515969; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidlove.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidlove.com"; sid:515970; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmailer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmailer.com"; sid:515971; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaps.com"; sid:515972; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmaskon.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmaskon.com"; sid:515973; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-masks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-masks.com"; sid:515974; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmatch.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmatch.com"; sid:515975; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmd.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmd.com"; sid:515976; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidme.com"; sid:515977; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmedia.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmedia.com"; sid:515978; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidmortgage.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidmortgage.com"; sid:515979; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidn95.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidn95.com"; sid:515980; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnearme.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnearme.com"; sid:515981; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnewsnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnewsnow.com"; sid:515982; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidnow.com"; sid:515983; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpandemics.com"; sid:515984; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpanic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpanic.com"; sid:515985; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-plan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-plan.com"; sid:515986; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidplan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidplan.com"; sid:515987; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpoetry.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpoetry.com"; sid:515988; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidpress.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidpress.com"; sid:515989; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidproducts.com"; sid:515990; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidprotectionproducts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidprotectionproducts.com"; sid:515991; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrapidcheck.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrapidcheck.com"; sid:515992; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrespirator.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrespirator.com"; sid:515993; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-risk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-risk.com"; sid:515994; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrisk.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrisk.com"; sid:515995; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidrobotic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidrobotic.com"; sid:515996; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafeguard.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafeguard.com"; sid:515997; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafe.life - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafe.life"; sid:515998; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-safety.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-safety.com"; sid:515999; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsafetymask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsafetymask.com"; sid:516000; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidscreen.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidscreen.com"; sid:516001; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseminar.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseminar.com"; sid:516002; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidseminars.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidseminars.com"; sid:516003; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-sense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-sense.com"; sid:516004; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsense.com"; sid:516005; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-shield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-shield.com"; sid:516006; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidshields.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidshields.com"; sid:516007; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsite.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsite.com"; sid:516008; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsoap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsoap.com"; sid:516009; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-stats.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-stats.com"; sid:516010; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstl.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstl.com"; sid:516011; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidstuff.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidstuff.com"; sid:516012; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-summit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-summit.com"; sid:516013; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsupplements.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsupplements.com"; sid:516014; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidsurvivors.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidsurvivors.com"; sid:516015; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteam.com"; sid:516016; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtestkits.com"; sid:516017; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidteststrip.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidteststrip.com"; sid:516018; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtexas.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtexas.com"; sid:516019; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthai.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthai.com"; sid:516020; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthailand.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthailand.com"; sid:516021; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidth.com"; sid:516022; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidthreat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidthreat.com"; sid:516023; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtimeline.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtimeline.com"; sid:516024; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoday.com"; sid:516025; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtoolkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtoolkit.com"; sid:516026; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtracking.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtracking.com"; sid:516027; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtravel.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtravel.com"; sid:516028; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidtreatments.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidtreatments.com"; sid:516029; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidual.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidual.com"; sid:516030; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covid-us.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covid-us.com"; sid:516031; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidus.net"; sid:516032; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidvirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidvirustest.com"; sid:516033; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidwear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidwear.com"; sid:516034; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxhandsanitizer.com"; sid:516035; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxnow.com"; sid:516036; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidxxhandsanitizer.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidxxhandsanitizer.com"; sid:516037; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for covidzombies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"covidzombies.com"; sid:516038; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crazycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crazycorona.com"; sid:516039; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crisiscommunicationsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crisiscommunicationsforcoronavirus.com"; sid:516040; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for crushcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"crushcorona.com"; sid:516041; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cryptocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cryptocoronavirus.com"; sid:516042; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cubacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cubacoronavirus.com"; sid:516043; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4coronavirus.com"; sid:516044; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cure4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cure4covid-19.com"; sid:516045; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for cureforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"cureforcovid.com"; sid:516046; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecoronav.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecoronav.com"; sid:516047; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecovid-19.com"; sid:516048; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecovid19.com"; sid:516049; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for curethecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"curethecovid.com"; sid:516050; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for currencycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"currencycorona.com"; sid:516051; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for czechcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"czechcoronavirus.com"; sid:516052; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dacoronaviruskit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dacoronaviruskit.com"; sid:516053; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dailycoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dailycoronamask.com"; sid:516054; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for daniellencorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"daniellencorona.com"; sid:516055; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadlycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadlycorona.com"; sid:516056; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for deadlycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"deadlycovid19.com"; sid:516057; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-coronavirus.com"; sid:516058; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for decoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"decoronavirus.com"; sid:516059; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for de-coronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"de-coronavirus.net"; sid:516060; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for defeatingcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"defeatingcoronavirus.com"; sid:516061; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for delawarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"delawarecoronavirus.com"; sid:516062; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for denvercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"denvercoronavirus.com"; sid:516063; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for desinfectioncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"desinfectioncoronavirus.com"; sid:516064; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for destroy-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"destroy-corona.com"; sid:516065; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detectcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detectcovid19.com"; sid:516066; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for detroitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"detroitcoronavirus.com"; sid:516067; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcovid-19.com"; sid:516068; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for djcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"djcovid19.com"; sid:516069; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnacovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnacovid-19.com"; sid:516070; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dnacovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dnacovid19.com"; sid:516071; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doccorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doccorona.com"; sid:516072; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-corona-virus.com"; sid:516073; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for do-i-have-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"do-i-have-coronavirus.com"; sid:516074; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doihavecoronavirusyet.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doihavecoronavirusyet.com"; sid:516075; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dominicancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dominicancoronavirus.com"; sid:516076; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcorona.com"; sid:516077; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for donaldtrumpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"donaldtrumpcoronavirus.com"; sid:516078; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgetcoronad.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgetcoronad.com"; sid:516079; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for dontgetcoronayall.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"dontgetcoronayall.com"; sid:516080; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for doyouhavecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"doyouhavecorona.com"; sid:516081; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcoronavirus.com"; sid:516082; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drcovid19.com"; sid:516083; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucorona.com"; sid:516084; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drivethrucoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drivethrucoronatest.com"; sid:516085; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for drug4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"drug4covid19.com"; sid:516086; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for easycoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"easycoronatest.com"; sid:516087; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ecuadorcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ecuadorcoronavirus.com"; sid:516088; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eftforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eftforcoronavirus.com"; sid:516089; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for egyptcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"egyptcoronavirus.com"; sid:516090; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ehime-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ehime-covid19.com"; sid:516091; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for elcoronaviruss.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"elcoronaviruss.com"; sid:516092; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eliminarecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eliminarecoronavirus.com"; sid:516093; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for emcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"emcoronavirus.com"; sid:516094; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for employeecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"employeecoronavirus.com"; sid:516095; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endcoronatoday.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endcoronatoday.com"; sid:516096; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endingcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endingcorona.com"; sid:516097; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for endofcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"endofcoronavirus.com"; sid:516098; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epandemics.com"; sid:516099; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicam.com"; sid:516100; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicarea.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicarea.com"; sid:516101; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-coronavirus.com"; sid:516102; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemic-data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemic-data.com"; sid:516103; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicdata.com"; sid:516104; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicetiquette.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicetiquette.com"; sid:516105; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicforesight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicforesight.com"; sid:516106; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicgear.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicgear.com"; sid:516107; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicmaps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicmaps.com"; sid:516108; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprotect.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprotect.com"; sid:516109; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicprotectionservices.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicprotectionservices.com"; sid:516110; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for epidemicshield.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"epidemicshield.com"; sid:516111; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for eradicatethecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"eradicatethecoronavirus19.com"; sid:516112; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for erasecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"erasecorona.com"; sid:516113; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecoronavirus.com"; sid:516114; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for escapecoronavirus.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"escapecoronavirus.net"; sid:516115; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ethiopiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ethiopiacoronavirus.com"; sid:516116; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fakecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fakecoronavirus.com"; sid:516117; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fasocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fasocoronavirus.com"; sid:516118; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fcukcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fcukcoronavirus.com"; sid:516119; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for feminicidiosvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"feminicidiosvscorona.com"; sid:516120; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcorona.com"; sid:516121; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcoronavirus.com"; sid:516122; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightagainstcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightagainstcovid-19.com"; sid:516123; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronaco.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronaco.com"; sid:516124; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-corona-virus.com"; sid:516125; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightcoronavirusnow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightcoronavirusnow.com"; sid:516126; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fight-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fight-covid.com"; sid:516127; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightingcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightingcovid19.com"; sid:516128; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fightvscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fightvscorona.com"; sid:516129; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for findcoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"findcoronavirustreatment.com"; sid:516130; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fingeredinwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fingeredinwuhan.com"; sid:516131; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for finishcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"finishcorona.com"; sid:516132; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fkcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fkcorona.com"; sid:516133; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for flcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"flcoronavirus.com"; sid:516134; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for floridacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"floridacovid.com"; sid:516135; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronascreening.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronascreening.com"; sid:516136; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustesting.com"; sid:516137; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustestkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustestkit.com"; sid:516138; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for freecoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"freecoronavirustestkits.com"; sid:516139; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for frenaelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"frenaelcoronavirus.com"; sid:516140; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fresnocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fresnocoronavirus.com"; sid:516141; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fuckucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fuckucorona.com"; sid:516142; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for fucorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"fucorona.com"; sid:516143; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for gacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"gacoronavirus.com"; sid:516144; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for georgiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"georgiacoronavirus.com"; sid:516145; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for germanycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"germanycoronavirus.com"; sid:516146; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronafacts.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronafacts.com"; sid:516147; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatest.com"; sid:516148; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronatesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronatesting.com"; sid:516149; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirusfacemasks.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirusfacemasks.com"; sid:516150; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronaviruspill.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronaviruspill.com"; sid:516151; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustest.com"; sid:516152; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustesting.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustesting.com"; sid:516153; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcoronavirustreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcoronavirustreatment.com"; sid:516154; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getcovid19shot.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getcovid19shot.com"; sid:516155; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getready4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getready4covid19.com"; sid:516156; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for getridofcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"getridofcorona.com"; sid:516157; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ghanacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ghanacoronavirus.com"; sid:516158; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronamap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronamap.com"; sid:516159; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusdata.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusdata.com"; sid:516160; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcoronavirusmap.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcoronavirusmap.com"; sid:516161; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19.com"; sid:516162; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalcovid19data.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalcovid19data.com"; sid:516163; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for globalepidemic.world - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"globalepidemic.world"; sid:516164; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for goawaycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"goawaycorona.com"; sid:516165; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greatpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greatpandemic.com"; sid:516166; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for greececoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"greececoronavirus.com"; sid:516167; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for grillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"grillcoronavirus.com"; sid:516168; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guatemalacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guatemalacoronavirus.com"; sid:516169; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guide-pratique-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guide-pratique-coronavirus.com"; sid:516170; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for guineacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"guineacoronavirus.com"; sid:516171; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for habichdencoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"habichdencoronavirus.com"; sid:516172; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haiticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haiticoronavirus.com"; sid:516173; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haltcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haltcorona.com"; sid:516174; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handle-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handle-corona.com"; sid:516175; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for handsanitizercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"handsanitizercoronavirus.com"; sid:516176; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveicorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveicorona.com"; sid:516177; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveigotcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveigotcorona.com"; sid:516178; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveigotcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveigotcovid-19.com"; sid:516179; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for haveyoursaycovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"haveyoursaycovid19.com"; sid:516180; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hawaiicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hawaiicoronavirus.com"; sid:516181; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heal-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heal-covid19.com"; sid:516182; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heal-covid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heal-covid.com"; sid:516183; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpanticorona.com"; sid:516184; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helpanticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helpanticoronavirus.com"; sid:516185; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for helppreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"helppreventcoronavirus.com"; sid:516186; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for heywuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"heywuhan.com"; sid:516187; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for historyofcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"historyofcovid19.com"; sid:516188; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronatest.com"; sid:516189; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronavirustest.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronavirustest.net"; sid:516190; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecoronavirustests.com"; sid:516191; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for homecovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"homecovid19test.com"; sid:516192; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hondurascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hondurascoronavirus.com"; sid:516193; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hongcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hongcoronavirus.com"; sid:516194; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for honolulucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"honolulucoronavirus.com"; sid:516195; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howmanydeadfromcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howmanydeadfromcoronavirus.com"; sid:516196; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtocurethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtocurethecoronavirus.com"; sid:516197; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtokillthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtokillthecoronavirus.com"; sid:516198; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtomakemoneyduringcoronaquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtomakemoneyduringcoronaquarantine.com"; sid:516199; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoprepareforapandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoprepareforapandemic.com"; sid:516200; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtopreventcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtopreventcovid19.com"; sid:516201; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtosurvivethecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtosurvivethecoronavirus.com"; sid:516202; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for howtoworkfromhomeduringcoronaquarantine.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"howtoworkfromhomeduringcoronaquarantine.com"; sid:516203; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hqcoronavirus.com"; sid:516204; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hungarycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hungarycoronavirus.com"; sid:516205; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygienecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygienecoronavirus.com"; sid:516206; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hygisoftanticorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hygisoftanticorona.com"; sid:516207; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypochlorousacidcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypochlorousacidcoronavirus.com"; sid:516208; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypochlorouscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypochlorouscoronavirus.com"; sid:516209; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for hypochlorouscovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"hypochlorouscovid-19.com"; sid:516210; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iacoronavirus.com"; sid:516211; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ibeatthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ibeatthecoronavirus.com"; sid:516212; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for icovid20.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"icovid20.com"; sid:516213; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idahocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idahocoronavirus.com"; sid:516214; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcorona.com"; sid:516215; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idcoronavirus.com"; sid:516216; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for idiotsforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"idiotsforcoronavirus.com"; sid:516217; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ifigetcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ifigetcorona.com"; sid:516218; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihadcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihadcoronavirus.com"; sid:516219; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ihavecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ihavecovid19.com"; sid:516220; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for illinoiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"illinoiscoronavirus.com"; sid:516221; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for impactcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"impactcovid19.com"; sid:516222; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indiacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indiacorona.com"; sid:516223; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianacoronavirus.com"; sid:516224; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indianapoliscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indianapoliscoronavirus.com"; sid:516225; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for indonesiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"indonesiacoronavirus.com"; sid:516226; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for infocovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"infocovid.com"; sid:516227; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for informacion-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"informacion-coronavirus.com"; sid:516228; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovativecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovativecorona.com"; sid:516229; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for innovativecovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"innovativecovid.com"; sid:516230; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecorona.com"; sid:516231; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insidecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insidecoronavirus.com"; sid:516232; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for insightcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"insightcovid.com"; sid:516233; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19test.com"; sid:516234; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for instantcovid19testing.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"instantcovid19testing.com"; sid:516235; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for internationalcoronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"internationalcoronamask.com"; sid:516236; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iowacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iowacoronavirus.com"; sid:516237; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iraqcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iraqcoronavirus.com"; sid:516238; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isitcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isitcoronavirus.com"; sid:516239; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isitcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isitcovid-19.com"; sid:516240; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for israelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"israelcoronavirus.com"; sid:516241; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for istherecoronavirusonmy.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"istherecoronavirusonmy.com"; sid:516242; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedarealpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedarealpandemic.com"; sid:516243; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for i-survived-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"i-survived-corona.com"; sid:516244; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvived-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvived-corona.com"; sid:516245; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for isurvivedcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"isurvivedcorona-virus.com"; sid:516246; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for itscoronavirustime.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"itscoronavirustime.com"; sid:516247; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for iwantcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"iwantcoronavirus.com"; sid:516248; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jacksonvillecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jacksonvillecoronavirus.com"; sid:516249; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jeremiahgrossmandrinkscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jeremiahgrossmandrinkscorona.com"; sid:516250; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for jingyutongwuhan.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"jingyutongwuhan.com"; sid:516251; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kaletracoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kaletracoronavirus.com"; sid:516252; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kansascoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kansascoronavirus.com"; sid:516253; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kawalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kawalcorona.com"; sid:516254; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kazakhstancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kazakhstancoronavirus.com"; sid:516255; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for k-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"k-corona.com"; sid:516256; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for keincorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"keincorona.com"; sid:516257; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kentuckycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kentuckycoronavirus.com"; sid:516258; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kenyacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kenyacoronavirus.com"; sid:516259; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kick-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kick-corona.com"; sid:516260; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcorona24.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcorona24.com"; sid:516261; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronanow.com"; sid:516262; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusnyc.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusnyc.com"; sid:516263; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcoronavirusservice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcoronavirusservice.com"; sid:516264; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovid19virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovid19virus.com"; sid:516265; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidswift.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidswift.com"; sid:516266; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killcovidvirus-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killcovidvirus-19.com"; sid:516267; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for killsthecoronavirus19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"killsthecoronavirus19.com"; sid:516268; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kingdomcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kingdomcoronavirus.com"; sid:516269; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-anticoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-anticoronavirus.com"; sid:516270; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kit-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kit-covid19.com"; sid:516271; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kitcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kitcovid19.com"; sid:516272; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowaboutcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowaboutcorona.com"; sid:516273; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for knowcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"knowcovid.com"; sid:516274; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kongcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kongcoronavirus.com"; sid:516275; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koreacovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koreacovid.com"; sid:516276; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for koronawiruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"koronawiruscovid19.com"; sid:516277; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kscoronavirus.com"; sid:516278; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kuwaitcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kuwaitcorona.com"; sid:516279; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for kycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"kycoronavirus.com"; sid:516280; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lab-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lab-corona.com"; sid:516281; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labcorpcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labcorpcorona.com"; sid:516282; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for labscorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"labscorona.com"; sid:516283; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamoreaitempidelcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamoreaitempidelcorona.com"; sid:516284; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lamoreaitempidelcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lamoreaitempidelcoronavirus.com"; sid:516285; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lankacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lankacoronavirus.com"; sid:516286; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lasolutionaucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lasolutionaucoronavirus.com"; sid:516287; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestoncoronavirus.com"; sid:516288; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for latestoncovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"latestoncovid19.com"; sid:516289; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawandthecoronaviruscrisis.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawandthecoronaviruscrisis.com"; sid:516290; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lawyerforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lawyerforcoronavirus.com"; sid:516291; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcovid19.com"; sid:516292; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcovid19cure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcovid19cure.com"; sid:516293; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lcovidcure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lcovidcure.com"; sid:516294; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for legalhelpcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"legalhelpcoronavirus.com"; sid:516295; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsbeatcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsbeatcoronavirus.com"; sid:516296; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for letsdieofcoronatogether.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"letsdieofcoronatogether.com"; sid:516297; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livecovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livecovid19.com"; sid:516298; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingonlinecorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingonlinecorona-virus.com"; sid:516299; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingonlinecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingonlinecoronavirus.com"; sid:516300; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcorona.com"; sid:516301; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for livingwithcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"livingwithcoronavirus.com"; sid:516302; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for localcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"localcoronavirus.com"; sid:516303; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for longbeachcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"longbeachcoronavirus.com"; sid:516304; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisianacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisianacoronavirus.com"; sid:516305; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for louisvillecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"louisvillecoronavirus.com"; sid:516306; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for lowcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"lowcorona.com"; sid:516307; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for macoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"macoronavirus.com"; sid:516308; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for madagascarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"madagascarcoronavirus.com"; sid:516309; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mainecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mainecoronavirus.com"; sid:516310; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malawicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malawicoronavirus.com"; sid:516311; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malaysiacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malaysiacoronavirus.com"; sid:516312; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for malicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"malicoronavirus.com"; sid:516313; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for manhattancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"manhattancoronavirus.com"; sid:516314; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for marylandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"marylandcoronavirus.com"; sid:516315; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarasparacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarasparacoronavirus.com"; sid:516316; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mascarillacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mascarillacorona.com"; sid:516317; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mask4covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mask4covid-19.com"; sid:516318; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskagainstcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskagainstcorona.com"; sid:516319; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcorona-virus.com"; sid:516320; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforcovid.com"; sid:516321; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for maskforthecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"maskforthecoronavirus.com"; sid:516322; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masks-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masks-covid19.com"; sid:516323; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for masksforcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"masksforcovid19.com"; sid:516324; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for massachusettscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"massachusettscoronavirus.com"; sid:516325; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mdcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mdcovid-19.com"; sid:516326; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mecoronavirus.com"; sid:516327; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for med-covid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"med-covid-19.com"; sid:516328; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mediacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mediacoronavirus.com"; sid:516329; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-coronamask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-coronamask.com"; sid:516330; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medical-coronamask.net - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medical-coronamask.net"; sid:516331; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for medicationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"medicationcorona.com"; sid:516332; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for memphiscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"memphiscoronavirus.com"; sid:516333; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mesacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mesacoronavirus.com"; sid:516334; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mexicocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mexicocoronavirus.com"; sid:516335; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for michigancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"michigancoronavirus.com"; sid:516336; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for micoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"micoronavirus.com"; sid:516337; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for microfluidiccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"microfluidiccovid.com"; sid:516338; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for milwaukeecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"milwaukeecoronavirus.com"; sid:516339; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minneapoliscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minneapoliscoronavirus.com"; sid:516340; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for minnesotacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"minnesotacoronavirus.com"; sid:516341; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mississippicoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mississippicoronavirus.com"; sid:516342; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouricorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouricorona.com"; sid:516343; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for missouricoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"missouricoronavirus.com"; sid:516344; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mitigatecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mitigatecoronavirus.com"; sid:516345; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mncoronavirus.com"; sid:516346; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mocoronavirus.com"; sid:516347; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modelcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modelcovid19.com"; sid:516348; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modelcovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modelcovid.com"; sid:516349; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernpandemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernpandemic.com"; sid:516350; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for modernpandemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"modernpandemics.com"; sid:516351; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moneycorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moneycorona.com"; sid:516352; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for monitorcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"monitorcorona.com"; sid:516353; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for montanacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"montanacoronavirus.com"; sid:516354; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moroccocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moroccocoronavirus.com"; sid:516355; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for moroccovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"moroccovid.com"; sid:516356; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mozambiquecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mozambiquecoronavirus.com"; sid:516357; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mscoronavirus.com"; sid:516358; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mtcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mtcoronavirus.com"; sid:516359; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mu-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mu-coronavirus.com"; sid:516360; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mucoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mucoronavirus.com"; sid:516361; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myanmarcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myanmarcoronavirus.com"; sid:516362; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronakiller.com"; sid:516363; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronalocations.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronalocations.com"; sid:516364; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronateam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronateam.com"; sid:516365; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusrights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusrights.com"; sid:516366; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirusteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirusteam.com"; sid:516367; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustest.com"; sid:516368; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustestingkit.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustestingkit.com"; sid:516369; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustestkits.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustestkits.com"; sid:516370; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycoronavirustests.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycoronavirustests.com"; sid:516371; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid19team.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid19team.com"; sid:516372; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovid411.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovid411.com"; sid:516373; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidmask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidmask.com"; sid:516374; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidreport.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidreport.com"; sid:516375; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidteam.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidteam.com"; sid:516376; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for mycovidtracker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"mycovidtracker.com"; sid:516377; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for myepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"myepidemic.com"; sid:516378; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95corona.com"; sid:516379; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for n95-prevent-epidemics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"n95-prevent-epidemics.com"; sid:516380; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for namastecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"namastecorona.com"; sid:516381; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for naturallykillcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"naturallykillcoronavirus.com"; sid:516382; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovcovid19.com"; sid:516383; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ncovidtaskforce.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ncovidtaskforce.com"; sid:516384; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ndcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ndcoronavirus.com"; sid:516385; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nebraskacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nebraskacoronavirus.com"; sid:516386; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for necoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"necoronavirus.com"; sid:516387; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for needtoknowcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"needtoknowcoronavirus.com"; sid:516388; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalcorona.com"; sid:516389; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nepalcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nepalcoronavirus.com"; sid:516390; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for netherlandscoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"netherlandscoronavirus.com"; sid:516391; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nettoyagecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nettoyagecoronavirus.com"; sid:516392; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nevadacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nevadacoronavirus.com"; sid:516393; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for new-corona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"new-corona-virus.com"; sid:516394; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcoronavirusupdates.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcoronavirusupdates.com"; sid:516395; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newcovid19mask.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newcovid19mask.com"; sid:516396; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newhampshirecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newhampshirecoronavirus.com"; sid:516397; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newjerseycoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newjerseycoronavirus.com"; sid:516398; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newmexicocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newmexicocoronavirus.com"; sid:516399; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscoronaviruscovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscoronaviruscovid19.com"; sid:516400; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newscovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newscovid.com"; sid:516401; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for newyorkcoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"newyorkcoronaviruscleaning.com"; sid:516402; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextcorona.com"; sid:516403; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nextepidemic.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nextepidemic.com"; sid:516404; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nhcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nhcoronavirus.com"; sid:516405; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nigercoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nigercoronavirus.com"; sid:516406; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nigeriacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nigeriacoronavirus.com"; sid:516407; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nmcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nmcoronavirus.com"; sid:516408; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nobelforcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nobelforcorona.com"; sid:516409; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nobelforcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nobelforcoronavirus.com"; sid:516410; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocorona4u.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocorona4u.com"; sid:516411; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronaflights.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronaflights.com"; sid:516412; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nocoronanow.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nocoronanow.com"; sid:516413; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nolikecoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nolikecoronavirus.com"; sid:516414; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nomigustacorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nomigustacorona.com"; sid:516415; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noncoronavirus.com"; sid:516416; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcarolinacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcarolinacoronavirus.com"; sid:516417; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northcoronavirus.com"; sid:516418; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for northdakotacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"northdakotacoronavirus.com"; sid:516419; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronavirus.com"; sid:516420; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcoronavirustshirt.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcoronavirustshirt.com"; sid:516421; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for notcovid-19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"notcovid-19.com"; sid:516422; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for noticiascovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"noticiascovid19.com"; sid:516423; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novel-corona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novel-corona.com"; sid:516424; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronacure.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronacure.com"; sid:516425; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcorona-test.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcorona-test.com"; sid:516426; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronatest.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronatest.com"; sid:516427; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronatreatment.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronatreatment.com"; sid:516428; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcorona-virus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcorona-virus.com"; sid:516429; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novelcoronavirushealth.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novelcoronavirushealth.com"; sid:516430; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for novocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"novocoronavirus.com"; sid:516431; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nuovo-coronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nuovo-coronavirus.com"; sid:516432; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nutritiontopreventcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nutritiontopreventcoronavirus.com"; sid:516433; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nvcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nvcoronavirus.com"; sid:516434; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronakiller.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronakiller.com"; sid:516435; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaspray.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaspray.com"; sid:516436; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for nycoronaviruscleaning.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"nycoronaviruscleaning.com"; sid:516437; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oaklandcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oaklandcoronavirus.com"; sid:516438; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for occoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"occoronavirus.com"; sid:516439; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocoronavirus.com"; sid:516440; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ocovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ocovid19.com"; sid:516441; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohcoronavirus.com"; sid:516442; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ohiocoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ohiocoronavirus.com"; sid:516443; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okaycovid.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okaycovid.com"; sid:516444; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcoronavirus.com"; sid:516445; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for okcovid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"okcovid19.com"; sid:516446; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oklahomacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oklahomacoronavirus.com"; sid:516447; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for omahacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"omahacoronavirus.com"; sid:516448; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for onlinecoronachecker.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"onlinecoronachecker.com"; sid:516449; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for operationcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"operationcorona.com"; sid:516450; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for orcoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"orcoronavirus.com"; sid:516451; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for oregoncoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"oregoncoronavirus.com"; sid:516452; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organizingduringcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organizingduringcorona.com"; sid:516453; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for organizingwhilecorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"organizingwhilecorona.com"; sid:516454; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ourcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ourcorona.com"; sid:516455; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for outbreakcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"outbreakcorona.com"; sid:516456; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for ozone4covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"ozone4covid19.com"; sid:516457; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pacoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pacoronavirus.com"; sid:516458; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pakistancoronavirus.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pakistancoronavirus.com"; sid:516459; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for palcorona.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"palcorona.com"; sid:516460; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-2020.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-2020.com"; sid:516461; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicadvice.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicadvice.com"; sid:516462; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicandrecession.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicandrecession.com"; sid:516463; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicchat.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicchat.com"; sid:516464; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicconspiracies.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicconspiracies.com"; sid:516465; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemiccoupons.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemiccoupons.com"; sid:516466; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemic-covid19.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemic-covid19.com"; sid:516467; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdeals.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdeals.com"; sid:516468; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdefense.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdefense.com"; sid:516469; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdiagnostics.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdiagnostics.com"; sid:516470; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicdigital.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicdigital.com"; sid:516471; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicfoodlist.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicfoodlist.com"; sid:516472; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicforesight.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicforesight.com"; sid:516473; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicgps.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicgps.com"; sid:516474; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemichumor.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemichumor.com"; sid:516475; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicimpact.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN - Produced by Malware Patrol"; content:"pandemicimpact.com"; sid:516476; )
alert udp any any -> any 53 ( msg:"Suspicious DNS lookup for pandemicknowledge.com - Covid-19 related suspicious domain (MP)"; rev:1676587113; rem:"TLP GREEN